ZOHO ManageEngine Applications Manager Elevation of Privilege Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. An elevation of privilege vulnerability exists in ZOHO ManageEngine Applications Manager versions 12 and 13. An attacker can exploit this vulnerability to gain elevated privileges...

ZOHO ManageEngine Applications Manager Remote Code Execution Vulnerability

ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. The software allows remote monitoring and management of different business systems, applications and network services e.g. servers, operating systems, etc.. A remote code execution...

CVE-2016-6600

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6601

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

CVE-2016-6601

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

CVE-2016-6603

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header...

CVE-2016-6600

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6602

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

CVE-2016-6603

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header...

Authentication flaw

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header...

Design/Logic Flaw

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

Directory traversal

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...

Directory traversal

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6600

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. dot dot in the fileName parameter to servlets/FileUploadServlet...

CVE-2016-6602

CVE-2016-6601 and CVE-2016-6602 affect ZOHO WebNMS Framework 5.2 and 5.2 SP1. CVE-2016-6601 is a local file inclusion in the file download path (servlets/FetchFile) allowing reading arbitrary files via a .. in fileName. CVE-2016-6602 describes weak obfuscation storing passwords in WEB-INF/conf/se...

CVE-2016-6601

CVE-2016-6601 — ZOHO WebNMS Framework is affected by a local file inclusion in the fileName parameter sent to servlets/FetchFile in versions before 5.2 SP1 (i.e., 5.2 and earlier). The vulnerability allows an attacker to read arbitrary files by manipulating the double-dot sequence in the filename...

CVE-2016-6603

CVE-2016-6603 affects ZOHO WebNMS Framework 5.2 and 5.2 SP1. The vulnerability allows remote attackers to bypass authentication and impersonate arbitrary users by sending a manipulated UserName HTTP header, enabling session hijacking via the GetChallengeServlet in WebNMS. Multiple connected sourc...

CVE-2016-6600

The CVE refers to a directory traversal vulnerability in WebNMS Framework Server 5.2 and 5.2 SP1 (ZOHO WebNMS) via FileUploadServlet, where a crafted fileName with .. allows remote attackers to upload and execute JSP files. A Metasploit module and multiple advisories document an arbitrary file up...

CVE-2016-6602

ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit...

CVE-2016-6601

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. dot dot in the fileName parameter to servlets/FetchFile...