CVE-2016-6603

CVE-2016-6603 affects ZOHO WebNMS Framework 5.2 and 5.2 SP1. The vulnerability allows remote attackers to bypass authentication and impersonate arbitrary users by sending a manipulated UserName HTTP header, enabling session hijacking via the GetChallengeServlet in WebNMS. Multiple connected sourc...

CVE-2016-6602

CVE-2016-6601 and CVE-2016-6602 affect ZOHO WebNMS Framework 5.2 and 5.2 SP1. CVE-2016-6601 is a local file inclusion in the file download path (servlets/FetchFile) allowing reading arbitrary files via a .. in fileName. CVE-2016-6602 describes weak obfuscation storing passwords in WEB-INF/conf/se...

CVE-2016-6601

CVE-2016-6601 — ZOHO WebNMS Framework is affected by a local file inclusion in the fileName parameter sent to servlets/FetchFile in versions before 5.2 SP1 (i.e., 5.2 and earlier). The vulnerability allows an attacker to read arbitrary files by manipulating the double-dot sequence in the filename...

CVE-2016-6600

The CVE refers to a directory traversal vulnerability in WebNMS Framework Server 5.2 and 5.2 SP1 (ZOHO WebNMS) via FileUploadServlet, where a crafted fileName with .. allows remote attackers to upload and execute JSP files. A Metasploit module and multiple advisories document an arbitrary file up...

CVE-2016-6601

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

CVE-2016-6600

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6602

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

OpManager 12100 / 12200 Cross Site Scripting / Denial Of Service

Title: Multiple issues in OpManager Author: Michael Heydon Product: OpManager Tested Versions: 12100 & 12200 Vendor: Zoho ManageEngine Vendor Notified: 2016-08-14 Disclosure Date: 2016-11-20 Product Description: ==================== OpManager is a web-based network monitoring system. It is used...

JVN#89726415: ManageEngine ServiceDesk Plus fails to restrict access permissions

ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus fails to restrict access permissions. Impact A user logged in with guest privileges may access functions for which permissions are not granted. Solution Update the software Update to...

JVN#50347324: ManageEngine ServiceDesk Plus vulnerable to cross-site scripting

ManageEngine ServiceDesk Plus provided by Zoho Corporation is a help desk software. ManageEngine ServiceDesk Plus contains a stored cross-site scripting CWE-79 vulnerability. Impact An arbitrary script may be executed on a web browser of a user that is logged in. Solution Update the software Upda...

Multiple Vulnerabilities in ZOHO WebNMS Framework

ZOHO WebNMS Framework is the United States ZhuoHao ZOHO company's set of framework for building network management applications. A directory traversal vulnerability, an information disclosure vulnerability, and a user impersonation vulnerability exist in versions 5.2 and 5.2 SP1 of the ZOHO WebNM...

Multiple Vulnerabilities in ZOHO WebNMS Framework (CNVD-2016-06371)

ZOHO WebNMS Framework is the United States ZhuoHao ZOHO company's set of framework for building network management applications. A directory traversal vulnerability, an information disclosure vulnerability, and a user impersonation vulnerability exist in versions 5.2 and 5.2 SP1 of the ZOHO WebNM...

Multiple vulnerabilities in ZOHO WebNMS Framework (CNVD-2016-06372)

ZOHO WebNMS Framework is the United States ZhuoHao ZOHO company's set of framework for building network management applications. A directory traversal vulnerability, an information disclosure vulnerability, and a user impersonation vulnerability exist in versions 5.2 and 5.2 SP1 of the ZOHO WebNM...

Multiple Vulnerabilities in ZOHO WebNMS Framework (CNVD-2016-06370)

ZOHO WebNMS Framework is the United States ZhuoHao ZOHO company's set of framework for building network management applications. A directory traversal vulnerability, an information disclosure vulnerability, and a user impersonation vulnerability exist in versions 5.2 and 5.2 SP1 of the ZOHO WebNM...

WebNMS Framework Detection

The script sends a connection request to the server and attempts to extract the version number from the reply. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability

ZOHO ManageEngine Applications Manager is a suite of application performance monitoring software. A SQL injection vulnerability exists in ZOHO ManageEngine Applications Manager, which allows remote attackers to exploit the vulnerability by submitting specially crafted SQL queries to manipulate or...

Multiple Vulnerabilities in ZOHO ManageEngine EventLog Analyzer

ZOHO ManageEngine EventLog Analyzer is the United States ZhuoHao ZOHO company's set of system, event log analysis software. HTML injection vulnerabilities and cross-site scripting vulnerabilities exist in ZOHO ManageEngine EventLog Analyzer version 11.0 Build 11000. These vulnerabilities can be...

Multiple Vulnerabilities in ZOHO ManageEngine Password Manager Pro

ZOHO ManageEngine Password Manager Pro PMP is a set of U.S. ZOHO ZOHO password management software. ZOHO ManageEngine PMP suffers from HTML injection, user enumeration, cross-site request forgery, power lifting, security bypass, and authentication bypass vulnerabilities. An attacker can exploit...

Multiple Vulnerabilities in ZOHO ManageEngine OpManager

ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software from ZOHO. The software provides monitoring configuration, alarms and notifications, monitoring reports and other functions. HTML injection vulnerabilities, cross-site scripting vulnerabilities,...

Zoho OpManager Cross Site Request Forgery / Cross Site Scripting

Reported these 27/08/2015 these were eventually fixed in version 12 because the entire application is based on emberjs now. There are no CVEs for these issues assigned nor is there any acknowledgement of the issues in any patches. Therefore only version 12 fixes these. Multiple stored and reflect...