Login Request a demo
Unscored severity · published Jun 9, 2015
CVE-2015-2960
Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
–
CVSS
2.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MN
Manageengine Netflow Analyzer · Zohocorp
All versions, or not specified · source: NVD
Affected product
MN
Manageengine Netflow Analyzer
Zohocorp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2960
Vendor Advisory
http://jvn.jp/en/jp/JVN98447310/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000074
www.securityfocus.com
http://www.securityfocus.com/bid/75071
www.securitytracker.com
http://www.securitytracker.com/id/1032516
Patch
https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerability-fix-for-fails-to-restrict-access-permissions-cross-site-scripting-cross-site-request-forgery-over-build-10250
More from Manageengine Netflow Analyzer
9.8
CVE-2019-12196
A SQL injection vulnerability in /client/api/json/v2/nfareports/compareReport in Zoho ManageEngine NetFlow Analyzer 12.3 allows attackers to execute arbitrary SQL commands via the…
8.8
CVE-2022-38772
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow…
8.8
CVE-2022-37024
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003,…
8.6
CVE-2023-47211
A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258
8.2
CVE-2022-35404
ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine