ManageEngine NetFlow Analyzer And IT360 Multiple servlets Arbitrary File Download (CVE-2014-5445)

An arbitrary file download vulnerability exists in ManageEngine Netflow Analyzer and IT360. The vulnerability is due to lack of authentication and insufficient input validation of the schFilePath parameter sent to servlets in HTTP requests. A remote unauthenticated attacker can download arbitrary...

ManageEngine NetFlow Analyzer And IT360 DisplayChartPDF Directory Traversal (CVE-2014-5446)

A directory traversal vulnerability exists in ManageEngine Netflow Analyzer and IT360. The vulnerability is due to lack of authentication and insufficient input validation on the filename parameter sent to the DisplayChartPDF servlet in HTTP requests. A remote unauthenticated attacker can downloa...

Directory traversal

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...

CVE-2014-9373

CVE-2014-9373 : A directory traversal vulnerability in the CollectorConfInfoServlet of ManageEngine NetFlow Analyzer allows remote code execution via a .. path component in uploaded filenames. Public sources (ZDI-14-422, NVD entry) describe that the flaw enables code execution with SYSTEM context...

CVE-2014-9373

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...

CVE-2014-9373: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. dot dot in the filename...

ManageEngine NetFlow Analyzer CollectorConfInfoServlet COLLECTOR_ID Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ManageEngine NetFlow Analyzer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CollectorConfInfoServlet servlet. The issue lies in the failure to...

CVE-2014-5446

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

Directory traversal

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

Path traversal

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

CVE-2014-5445

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

CVE-2014-5445

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

CVE-2014-5445

CVE-2014-5445/5446 affect ZOHO ManageEngine NetFlow Analyzer (versions 8.6–10.2) and IT360 (10.3). The root cause is directory traversal via unvalidated user input in schFilePath to CSVServlet or CReportPDFServlet (CVE-2014-5445) and via the filename parameter to DisplayChartPDF (CVE-2014-5446). ...

CVE-2014-5446

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2014-5446

CVE-2014-5446 affects ZOHO ManageEngine NetFlow Analyzer (versions 8.6–10.2) and IT360 10.3. The vulnerability resides in the DisplayChartPDF servlet, where input validation for the filename parameter is insufficient, enabling directory traversal via .. to read arbitrary server files. Both remote...

CVE-2014-5446: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2014-5445: Improper Limitation of a Pathname to a Restricted Directory

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

ManageEngine Netflow Analyzer IT360 - Arbitrary File Download

ManageEngine Netflow Analyzer IT360 - Arbitrary File Download Arbitrary file download in ManageEngine Netflow Analyzer and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 30/11/20...

ManageEngine Netflow Analyzer / IT360 - Arbitrary File Download

Arbitrary file download in ManageEngine Netflow Analyzer and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 30/11/2014 / Last updated: 3/12/2014 Background on the affected produc...

ManageEngine Netflow Analyzer / IT360 File Download Vulnerability

ManageEngine Netflow Analyzer and IT360 suffer from an arbitrary file download vulnerability. This is part 9 of the ManageOwnage series. For previous parts see 1. Today we have yet another 0 day - an arbitrary file download vulnerability that be exploited unauthenticated in NetFlow Analyzer and...