CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6346
https://notcve.org/view.php?id=CVE-2013-6346
Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Vulnerabilidad cross-site request forgery (CSRF) en la página ZCC en Novell ZENworks Configuration Management (ZCM) anterior a 11.2.4 que permite a atacantes remotos secuestrar la autenticación de las víctimas no especificadas a través de vectores desconocidos. • http://www.novell.com/support/kb/doc.php?id=7012027 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6347
https://notcve.org/view.php?id=CVE-2013-6347
Session fixation vulnerability in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack web sessions via unspecified vectors. Vulnerabilidad de fijación de sesión de Novell ZENworks Configuration Management (ZCM) anterior a 11.2.4 que permite a atacantes remotos secuestrar sesiones web a través de vectores no especificados. • http://www.novell.com/support/kb/doc.php?id=7012027 • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6344
https://notcve.org/view.php?id=CVE-2012-6344
Novell ZENworks Configuration Management before 11.2.4 allows XSS. Novell ZENworks Configuration Management versiones anteriores a 11.2.4, permite un ataque de tipo XSS. • https://support.microfocus.com/kb/doc.php?id=7012761 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6345
https://notcve.org/view.php?id=CVE-2012-6345
Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information. Novell ZENworks Configuration Management versiones anteriores a 11.2.4, permite obtener información de rastreo confidencial. • https://support.microfocus.com/kb/doc.php?id=7012763 •
CVSS: 10.0EPSS: 86%CPEs: 2EXPL: 2CVE-2013-1080 – Novell ZENworks Control Center File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2013-1080
The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443. El servidor web en ZENworks Configuration Management (ZCM) de Novell versión 10.3 y versión 11.2 anteriores a 11.2.4, no realiza apropiadamente la autenticación para el archivo zenworks/jsp/index.jsp, lo que permite a los atacantes remotos realizar ataques de salto de directorio y en consecuencia cargar y ejecutar programas arbitrarios, por medio de una petición al puerto TCP 443. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENworks. Authentication is not required to exploit this vulnerability. The specific issues exists within ZENworks Control Center which listens on tcp/443 by default. Insufficient authentication checking on /zenworks/jsp/index.jsp allows a remote attacker to upload files to the webserver. • https://www.exploit-db.com/exploits/24938 http://www.exploit-db.com/exploits/24938 http://www.novell.com/support/kb/doc.php?id=7011812 http://www.novell.com/support/kb/doc.php?id=7012027 http://www.zerodayinitiative.com/advisories/ZDI-13-049 • CWE-287: Improper Authentication •