CVE-2014-6037

no score yetEPSS 84%

zohocorp manageengine eventlog analyzer: no CVSS score yet. EPSS 84% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.

EPSS: 84% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2014-10-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zohocorp:manageengine_eventlog_analyzer

References

http://osvdb.org/show/osvdb/110642
http://packetstormsecurity.com/files/128102/ManageEngine-EventLog-Analyzer-9.9-Authorization-Code-Execution.html
http://seclists.org/fulldisclosure/2014/Aug/86
http://seclists.org/fulldisclosure/2014/Sep/1
http://seclists.org/fulldisclosure/2014/Sep/19

Check your stack JSON