CVE-2014-5446

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

Path traversal

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

Directory traversal

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2014-5445

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

CVE-2014-5446

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2014-5445

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

CVE-2014-5445

CVE-2014-5445/5446 affect ZOHO ManageEngine NetFlow Analyzer (versions 8.6–10.2) and IT360 (10.3). The root cause is directory traversal via unvalidated user input in schFilePath to CSVServlet or CReportPDFServlet (CVE-2014-5445) and via the filename parameter to DisplayChartPDF (CVE-2014-5446). ...

CVE-2014-5446

CVE-2014-5446 affects ZOHO ManageEngine NetFlow Analyzer (versions 8.6–10.2) and IT360 10.3. The vulnerability resides in the DisplayChartPDF servlet, where input validation for the filename parameter is insufficient, enabling directory traversal via .. to read arbitrary server files. Both remote...

PT-2014-6477

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Netflow Analyzer versions 8.6 through 10.2 Zoho ManageEngine IT360 version 10.3 Description A directory traversal issue exists in the DisplayChartPDF servlet, allowing remote attackers and remote authenticated users to read...

PT-2014-6476

Name of the Vulnerable Software and Affected Versions ManageEngine Netflow Analyzer versions 8.6 through 10.2 IT360 version 10.3 Description The issue allows remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the CSVServlet o...

CVE-2014-5446: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. dot dot in the filename parameter...

CVE-2014-5445: Improper Limitation of a Pathname to a Restricted Directory

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the 1 CSVServlet or 2 CReportPDFServlet servlet...

ManageEngine Netflow Analyzer IT360 - Arbitrary File Download

ManageEngine Netflow Analyzer IT360 - Arbitrary File Download Arbitrary file download in ManageEngine Netflow Analyzer and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 30/11/20...

ManageEngine Netflow Analyzer / IT360 - Arbitrary File Download

Arbitrary file download in ManageEngine Netflow Analyzer and IT360 Discovered by Pedro Ribeiro [email protected], Agile Information Security ========================================================================== Disclosure: 30/11/2014 / Last updated: 3/12/2014 Background on the affected produc...

ManageEngine Netflow Analyzer / IT360 File Download Vulnerability

ManageEngine Netflow Analyzer and IT360 suffer from an arbitrary file download vulnerability. This is part 9 of the ManageOwnage series. For previous parts see 1. Today we have yet another 0 day - an arbitrary file download vulnerability that be exploited unauthenticated in NetFlow Analyzer and...

ManageEngine Netflow Analyzer / IT360 File Download

Hi, This is part 9 of the ManageOwnage series. For previous parts see 1. Today we have yet another 0 day - an arbitrary file download vulnerability that be exploited unauthenticated in NetFlow Analyzer and authenticated in IT360. I'm releasing this as a 0 day because ManageEngine have been making...

NetFlow Analyzer security vulnerabilities

Directory traversal...

[The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360

Hi, This is part 9 of the ManageOwnage series. For previous parts see 1. Today we have yet another 0 day - an arbitrary file download vulnerability that be exploited unauthenticated in NetFlow Analyzer and authenticated in IT360. I'm releasing this as a 0 day because ManageEngine have been making...

ManageEngine NetFlow Analyzer Arbitrary File Download

This module exploits an arbitrary file download vulnerability in CSVServlet on ManageEngine NetFlow Analyzer. This module has been tested on both Windows and Linux with versions 8.6 to 10.2. Note that when typing Windows paths, you must escape the backslash with a backslash. Module Options msf us...

NetFlow Analyzer 5 /jspui/selectDevice.jsp rtype Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/24766/info NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in th...