CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 4CVE-2018-12997 – Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion
https://notcve.org/view.php?id=CVE-2018-12997
29 Jun 2018 — Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows attackers to read certain files on the web server without login by sending a specially crafted request to the server with the operation=copyfile&fileName= substring. Control de acceso incorrecto en FailOverHelperServlet en Zoho ManageEngine Ne... • https://packetstorm.news/files/id/148635 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 94%CPEs: 5EXPL: 5CVE-2018-12998 – Zoho ManageEngine 13 (13790 build) XSS / File Read / File Deletion
https://notcve.org/view.php?id=CVE-2018-12998
29 Jun 2018 — A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote attackers to inject arbitrary web script or HTML via the parameter 'operation' to /servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet. Una vulnerabilidad Cross-Site Scripting (XSS) reflejado en Zoho ManageEngine Netflow... • https://packetstorm.news/files/id/148635 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2017-14123
https://notcve.org/view.php?id=CVE-2017-14123
04 Sep 2017 — Zoho ManageEngine Firewall Analyzer 12200 has an unrestricted File Upload vulnerability in the "Group Chat" section. Any user can upload files with any extensions. By uploading a PHP file to the server, an attacker can cause it to execute in the server context, as demonstrated by /itplus/FileStorage/302/shell.jsp. Zoho ManageEngine Firewall Analyzer 12200 tiene una vulnerabilidad de subida de archivos sin restricción en la sección "Group Chat". Cualquier usuario podría subir archivos con cualquier extensión... • https://blogs.securiteam.com/index.php/archives/3228 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7781
https://notcve.org/view.php?id=CVE-2015-7781
27 Jun 2017 — ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions. ManageEngine Firewall Analyzer anterior a la versión 8.0 no restringe los permisos de acceso. • http://jvn.jp/en/jp/JVN12991684/index.html • CWE-275: Permission Issues •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7780
https://notcve.org/view.php?id=CVE-2015-7780
27 Jun 2017 — Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0. Vulnerabilidad salto de directorio en ManageEngine Firewall Analyzer anterior a la versión 8.0. • http://jvn.jp/en/jp/JVN21968837/index.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •