CVSS: 10.0EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6345
https://notcve.org/view.php?id=CVE-2013-6345
Unspecified vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 has unknown impact and attack vectors related to an "Application Exception." Vulnerabilidad no especificada en la página ZCC en Novell ZENworks Configuration Management (ZCM) anterior a 11.2.4 que tiene un impacto desconocido y vectores de ataque relacionado con una "Excepción de aplicación." • http://www.novell.com/support/kb/doc.php?id=7012027 •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6346
https://notcve.org/view.php?id=CVE-2013-6346
Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Vulnerabilidad cross-site request forgery (CSRF) en la página ZCC en Novell ZENworks Configuration Management (ZCM) anterior a 11.2.4 que permite a atacantes remotos secuestrar la autenticación de las víctimas no especificadas a través de vectores desconocidos. • http://www.novell.com/support/kb/doc.php?id=7012027 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6345
https://notcve.org/view.php?id=CVE-2012-6345
Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information. Novell ZENworks Configuration Management versiones anteriores a 11.2.4, permite obtener información de rastreo confidencial. • https://support.microfocus.com/kb/doc.php?id=7012763 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6344
https://notcve.org/view.php?id=CVE-2012-6344
Novell ZENworks Configuration Management before 11.2.4 allows XSS. Novell ZENworks Configuration Management versiones anteriores a 11.2.4, permite un ataque de tipo XSS. • https://support.microfocus.com/kb/doc.php?id=7012761 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 4%CPEs: 8EXPL: 0CVE-2013-1079 – Novell ZENWorks AdminStudio ISProxy ActiveX Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-1079
Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method. Vulnerabilidad de salto de directorio en el método ISCreateObject en un control ActiveX en InstallShield\ISProxy.dll en AdminStudio in Novell ZENworks Configuration Management (ZCM) v10.3 hasta v11.2 permite a atacantes remotos ejecutar archivos DLL locales a través de una página web manipulada para que también llame al método Initialize. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENworks Admin Studio. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ISProxy.dll ActiveX object. The ISCreateObject() method suffers from a directory vulnerability and it is also possible to break the search path through a null char. • http://www.novell.com/support/kb/doc.php?id=7011811 http://www.zerodayinitiative.com/advisories/ZDI-13-048 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •