CVSS: 9.8EPSS: 3%CPEs: 2EXPL: 5CVE-2016-6602 – WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2016-6602
ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit. ZOHO WebNMS Framework 5.2 y 5.2 SP1 utiliza un algoritmo de ofuscación débil para almacenar contraseñas, lo que permite a atacantes dependientes de contexto obtener contraseñas en texto plano aprovechando el acceso a WEB-INF/conf/securitydbData.xml. NOTA: este problema puede combinarse con CVE-2016-6601 para una explotación remota. WebNMS Framework versions 5.2 and 5.2 SP1 suffer from directory traversal, code execution, weak obfuscation, and user impersonation vulnerabilities. • https://www.exploit-db.com/exploits/40229 http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html http://seclists.org/fulldisclosure/2016/Aug/54 http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_cred_disclosure http://www.securityfocus.com/archive/1/539159/100/0/threaded http://www.securityfocus.com/bid/92402 https://blogs.securiteam.com/index.php/archives/2712 https://forums.webnms.com/topic/recent-vulnerabilities-in- • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 97%CPEs: 2EXPL: 5CVE-2016-6600 – WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2016-6600
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet. Vulnerabilidad de salto de directorio la funcionalidad de carga de archivos en ZOHO WebNMS Framework 5.2 y 5.2 SP1 permite a atacantes remotos cargar y ejecutar archivos JSP arbitrarios a través de un .. (punto punto) en el parámetro fileName para servlets/FileUploadServlet. WebNMS Framework versions 5.2 and 5.2 SP1 suffer from directory traversal, code execution, weak obfuscation, and user impersonation vulnerabilities. • https://www.exploit-db.com/exploits/40229 http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html http://seclists.org/fulldisclosure/2016/Aug/54 http://www.securityfocus.com/archive/1/539159/100/0/threaded http://www.securityfocus.com/bid/92402 https://blogs.securiteam.com/index.php/archives/2712 https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them https://github.com/pedrib/ • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 97%CPEs: 2EXPL: 5CVE-2016-6601 – WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2016-6601
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile. Vulnerabilidad de salto de directorio en la funcionalidad de descarga de archivos en ZOHO WebNMS Framework 5.2 y 5.2 SP1 permite a atacantes remotos leer archivos arbitrarios a través de un .. (punto punto) en el parámetro fileName para servlets/FetchFile. WebNMS Framework versions 5.2 and 5.2 SP1 suffer from directory traversal, code execution, weak obfuscation, and user impersonation vulnerabilities. • https://www.exploit-db.com/exploits/40229 http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html http://seclists.org/fulldisclosure/2016/Aug/54 http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_cred_disclosure http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_file_download http://www.securityfocus.com/archive/1/539159/100/0/threaded http://www.securityfocus.com/bid/92402 https://blogs.securiteam.com/inde • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 95%CPEs: 2EXPL: 5CVE-2016-6603 – WebNMS Framework Server 5.2/5.2 SP1 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2016-6603
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. ZOHO WebNMS Framework 5.2 y 5.2 SP1 permite a atacantes remotos eludir la autenticación y suplantar usuarios arbitrarios a través del encabezado HTTP UserName. WebNMS Framework versions 5.2 and 5.2 SP1 suffer from directory traversal, code execution, weak obfuscation, and user impersonation vulnerabilities. • https://www.exploit-db.com/exploits/40229 http://packetstormsecurity.com/files/138244/WebNMS-Framework-5.2-SP1-Traversal-Weak-Obfuscation-User-Impersonation.html http://seclists.org/fulldisclosure/2016/Aug/54 http://www.securityfocus.com/archive/1/539159/100/0/threaded http://www.securityfocus.com/bid/92402 https://blogs.securiteam.com/index.php/archives/2712 https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them https://github.com/pedrib/ • CWE-20: Improper Input Validation •