CVE-2016-6600

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6600

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6603

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header...

CVE-2016-6601

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

CVE-2016-6601

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

CVE-2016-6603

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header...

CVE-2016-6602

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

Design/Logic Flaw

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

Directory traversal

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

Directory traversal

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6600

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6601

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

CVE-2016-6600

The CVE refers to a directory traversal vulnerability in WebNMS Framework Server 5.2 and 5.2 SP1 (ZOHO WebNMS) via FileUploadServlet, where a crafted fileName with .. allows remote attackers to upload and execute JSP files. A Metasploit module and multiple advisories document an arbitrary file up...

CVE-2016-6602

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

PT-2017-8999

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 through 5.2 SP1 Description A directory traversal issue exists in the file download functionality, allowing remote attackers to read arbitrary files. This is achieved by including a .. dot dot in the fileName...

PT-2017-8998

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 through 5.2 SP1 Description A directory traversal issue exists in the file upload functionality, allowing remote attackers to upload and execute arbitrary JSP files. This is achieved by including a .. dot dot...

CVE-2016-6600: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6601: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

PT-2017-9000

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 and 5.2 SP1 Description The issue allows context-dependent attackers to obtain cleartext passwords by leveraging access to the "WEB-INF/conf/securitydbData.xml" file, due to the use of a weak obfuscation...

PT-2017-9001

Name of the Vulnerable Software and Affected Versions ZOHO WebNMS Framework versions 5.2 and 5.2 SP1 Description The issue allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. Recommendations For ZOHO WebNMS Framework versions 5.2 and 5.2...