ManageEngine Netflow Analyzer vulnerabilities

2 CVEs affecting ManageEngine Netflow Analyzer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-9373, published 2014-12-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-9373, published 2014-12-16. High severity, CVSS 10.0. EPSS: 6.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. (dot dot) in the filename.
CVE-2009-3903, published 2009-11-06. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in jspui/index.jsp in ManageEngine Netflow Analyzer 7.5 build 7500 allow remote attackers to inject arbitrary web script or HTML via the (1) view…