GCVE - cpe:2.3:a:zohocorp:webnms_framework:5.2:sp1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:zohocorp:webnms_framework:5.2:sp1:*:*:*:*:*:*

part: a version: 5.2 update: sp1

Vendor	Zohocorp (`4f1ab088-ab0e-54ac-b0dc-2304879a7502`)
Product	Webnms Framework (`5e5ad5a7-5848-54d5-9fe5-4c57b938a4b7`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-6603`	vulnerable	2026-06-08 05:08:02.861296	Details available ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. Published: 2017-01-23T21:00:00.000Z Updated: 2024-08-06T01:36:28.258Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2016/Aug/54 https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them http://www.securityfocus.com/bid/92402 https://www.exploit-db.com/exploits/40229/ http://www.securityfocus.com/archive/1/539159/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6602`	vulnerable	2026-06-08 05:08:02.860875	Details available ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit. Published: 2017-01-23T21:00:00.000Z Updated: 2024-08-06T01:36:28.132Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2016/Aug/54 https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them http://www.securityfocus.com/bid/92402 https://www.exploit-db.com/exploits/40229/ http://www.securityfocus.com/archive/1/539159/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6601`	vulnerable	2026-06-08 05:08:02.860329	Details available Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter to servlets/FetchFile. Published: 2017-01-23T21:00:00.000Z Updated: 2024-08-06T01:36:29.184Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2016/Aug/54 https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them http://www.securityfocus.com/bid/92402 http://www.rapid7.com/db/modules/auxiliary/admin/http/webnms_file_download https://www.exploit-db.com/exploits/40229/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6600`	vulnerable	2026-06-08 05:08:02.859762	Details available Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet. Published: 2017-01-23T21:00:00.000Z Updated: 2024-08-06T01:36:28.185Z Open on db.gcve.eu Reference links http://seclists.org/fulldisclosure/2016/Aug/54 https://forums.webnms.com/topic/recent-vulnerabilities-in-webnms-and-how-to-protect-the-server-against-them http://www.securityfocus.com/bid/92402 https://www.exploit-db.com/exploits/40229/ http://www.securityfocus.com/archive/1/539159/100/0/threaded	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.