Page 2 of 29 results (0.005 seconds)

CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0

CVE-2013-6346

https://notcve.org/view.php?id=CVE-2013-6346

02 Nov 2013 — Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Vulnerabilidad cross-site request forgery (CSRF) en la página ZCC en Novell ZENworks Configuration Management (ZCM) anterior a 11.2.4 que permite a atacantes remotos secuestrar la autenticación de las víctimas no especificadas a través de vectores desconocidos. • http://www.novell.com/support/kb/doc.php?id=7012027 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 9.1EPSS: 2%CPEs: 9EXPL: 0

CVE-2013-6347

https://notcve.org/view.php?id=CVE-2013-6347

02 Nov 2013 — Session fixation vulnerability in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack web sessions via unspecified vectors. Vulnerabilidad de fijación de sesión de Novell ZENworks Configuration Management (ZCM) anterior a 11.2.4 que permite a atacantes remotos secuestrar sesiones web a través de vectores no especificados. • http://www.novell.com/support/kb/doc.php?id=7012027 • CWE-287: Improper Authentication •

CVSS: 7.8EPSS: 5%CPEs: 1EXPL: 0

CVE-2013-1084 – Novell ZENworks umaninv Information Disclosure Vulnerability

https://notcve.org/view.php?id=CVE-2013-1084

02 Nov 2013 — Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename parameter in a GetFile action to zenworks-unmaninv/. Vulnerabilidad de salto de directorio en el método GetFle del servicio umaninv de Novell ZENworks Configuration Management (ZCM) 11.2.3 que permite a atacantes remotos leer archivos de su elección a través de .. (punto punto) en el parámetro... • http://secunia.com/advisories/55450 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2012-6344 – CyberArk Vault User Enumeration

https://notcve.org/view.php?id=CVE-2012-6344

29 Aug 2013 — Novell ZENworks Configuration Management before 11.2.4 allows XSS. Novell ZENworks Configuration Management versiones anteriores a 11.2.4, permite un ataque de tipo XSS. CyberArk Vault versions prior to 7.20.37 suffer from multiple user enumeration vulnerabilities. • https://support.microfocus.com/kb/doc.php?id=7012761 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2012-6345 – CyberArk Vault User Enumeration

https://notcve.org/view.php?id=CVE-2012-6345

29 Aug 2013 — Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information. Novell ZENworks Configuration Management versiones anteriores a 11.2.4, permite obtener información de rastreo confidencial. CyberArk Vault versions prior to 7.20.37 suffer from multiple user enumeration vulnerabilities. • https://support.microfocus.com/kb/doc.php?id=7012763 •

CVSS: 6.1EPSS: 2%CPEs: 4EXPL: 0

CVE-2013-1093

https://notcve.org/view.php?id=CVE-2013-1093

17 Jun 2013 — Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the directToPage parameter. Vulnerabilidad de redirección abierta en la función fwdToURL la pagina de login de ZCC en zcc-framework.jar en Novell ZENworks Configuration Management (ZCM) v11.2 anterior a v11.2.3a Monthly Update 1 pe... • http://www.novell.com/support/kb/doc.php?id=7012025 • CWE-20: Improper Input Validation •

CVSS: 6.1EPSS: 2%CPEs: 4EXPL: 0

CVE-2013-1094

https://notcve.org/view.php?id=CVE-2013-1094

17 Jun 2013 — Cross-site scripting (XSS) vulnerability in a ZCC page in zenworks-core in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via an invalid locale. Vulnerabilidad Cross-site scripting (XSS) en la pagina ZCC en zenworks-core en Novell ZENworks Configuration Management (ZCM) v11.2 anterior a v11.2.3a Monthly Update 1 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un "locale" inv... • http://www.novell.com/support/kb/doc.php?id=7012025 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 0

CVE-2013-1095

https://notcve.org/view.php?id=CVE-2013-1095

17 Jun 2013 — Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError event. Vulnerabilidad Cross-site scripting (XSS) en la pagina ZCC en njwc.jar en Novell ZENworks Configuration Management (ZCM) v11.2 anterior a v11.2.3a Monthly Update 1 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a tra... • http://www.novell.com/support/kb/doc.php?id=7012025 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 1%CPEs: 4EXPL: 0

CVE-2013-1097

https://notcve.org/view.php?id=CVE-2013-1097

17 Jun 2013 — Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onload event. Vulnerabilidad Cross-site scripting (XSS) en la pagina ZCC en njwc.jar en Novell ZENworks Configuration Management (ZCM) v11.2 anterior a v11.2.3a Monthly Update 1 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a trav... • http://www.novell.com/support/kb/doc.php?id=7012025 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 2%CPEs: 8EXPL: 0

CVE-2013-1079 – Novell ZENWorks AdminStudio ISProxy ActiveX Remote Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2013-1079

22 Mar 2013 — Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method. Vulnerabilidad de salto de directorio en el método ISCreateObject en un control ActiveX en InstallShield\ISProxy.dll en AdminStudio in Novell ZENworks Configuration Management (ZCM) v10.3 hast... • http://www.novell.com/support/kb/doc.php?id=7011811 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •