Zohocorp Manageengine Netflow Analyzer — known CVE vulnerabilities

Every CVE whose affected-product data names Zohocorp Manageengine Netflow Analyzer, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (28)

• CVE-2019-12196 — CVSS 9.8 (critical): A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers…
• CVE-2023-47211 — CVSS 9.1 (critical): A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. A specially crafted HTTP…
• CVE-2022-38772 — CVSS 8.8 (high): Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658…
• CVE-2022-37024 — CVSS 8.8 (high): Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29…
• CVE-2022-35404 — CVSS 8.2 (high): ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation…
• CVE-2019-12133 — CVSS 7.8 (high): Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine…
• CVE-2022-36923 — CVSS 7.5 (high): Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils…
• CVE-2018-12997 — CVSS 7.5 (high): Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager…
• CVE-2015-2959 — CVSS 7.5 (high): Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain…
• CVE-2015-2961 — CVSS 6.8 (medium): Cross-site request forgery (CSRF) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the…
• CVE-2019-8927 — CVSS 6.1 (medium): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone…
• CVE-2019-8928 — CVSS 6.1 (medium): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via…
• CVE-2019-8929 — CVSS 6.1 (medium): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone…
• CVE-2018-10803 — CVSS 6.1 (medium): Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125…
• CVE-2018-12998 — CVSS 6.1 (medium): A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration…
• CVE-2019-7422 — CVSS 6.1 (medium): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file…
• CVE-2019-7423 — CVSS 6.1 (medium): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/editProfile.jsp" file in…
• CVE-2019-7424 — CVSS 6.1 (medium): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the…
• CVE-2019-7425 — CVSS 6.1 (medium): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp"…
• CVE-2019-7426 — CVSS 6.1 (medium): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp"…
• CVE-2019-7427 — CVSS 6.1 (medium): XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp"…
• CVE-2019-8926 — CVSS 6.1 (medium): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone…
• CVE-2023-6105 — CVSS 5.5 (medium): An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A…
• CVE-2015-4418 — CVSS 5.0 (medium): Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for…
• CVE-2014-5446 — CVSS 5.0 (medium): Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3…
• CVE-2014-5445 — CVSS 5.0 (medium): Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote…
• CVE-2019-8925 — CVSS 4.3 (medium): An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the…
• CVE-2015-2960 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web…