44 matches found
EUVD-2019-16967
Malware in sbrugna...
EUVD-2019-16969
Malware in sbrugna...
CVE-2019-12196: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the DeviceID parameter...
PT-2019-12692
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine NetFlow Analyzer version 12.3 Description A SQL injection issue allows attackers to execute arbitrary SQL commands via the DeviceID parameter in the "/client/api/json/v2/nfareports/compareReport" API endpoint. Recommendations...
CVE-2019-8926
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource...
Path traversal
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet via the parameter schFilePath, allows remote authenticated users to bypass intended SecurityManager...
CVE-2019-8929: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file in these GET parameters: param and rtype...
CVE-2019-8926: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert, customDev, and selSource...
CVE-2019-8928: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth, passWord, pwd1, and userName...
PT-2019-19261
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 Description An issue allows remote authenticated users to bypass intended SecurityManager restrictions. This is due to an Absolute Path Traversal vulnerability in the Administrati...
PT-2019-19262
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 Description An issue exists in the Administration zone of the software. Cross-site scripting XSS is possible in the /netflow/jspui/popup1.jsp file via the bussAlert, customDev, an...
CVE-2019-8925: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet via the parameter schFilePath, allows remote authenticated users to bypass intended SecurityManager...
PT-2019-19263
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 Description An issue exists in the Administration zone of the software. Cross-site scripting XSS is possible in the /netflow/jspui/scheduleConfig.jsp file via several GET...
PT-2019-19264
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 Description A security issue was found in the software, where a cross-site scripting XSS attack is possible. This occurs in the "/netflow/jspui/userManagementForm.jsp" API endpoin...
CVE-2019-8927: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc, emailId, excWeekModify, filterFlag, getFilter, mailReport, mset, popup, repschedule, repType, schDesc,...
CVE-2019-7427
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefTime or graphTypes parameter...
CVE-2019-7426: Improper Neutralization of Input During Web Page Generation
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDesc, groupName, groupID, or task parameter...
CVE-2019-7427: Improper Neutralization of Input During Web Page Generation
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the autorefTime or graphTypes parameter...
PT-2019-18600
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2 Description A security issue exists in the Administration zone of the software, specifically in the "/netflow/jspui/linkdownalertConfig.jsp" file. The issue is related to the...