CVSS: 6.8EPSS: 0%CPEs: 9EXPL: 0CVE-2013-6346
https://notcve.org/view.php?id=CVE-2013-6346
Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Vulnerabilidad cross-site request forgery (CSRF) en la página ZCC en Novell ZENworks Configuration Management (ZCM) anterior a 11.2.4 que permite a atacantes remotos secuestrar la autenticación de las víctimas no especificadas a través de vectores desconocidos. • http://www.novell.com/support/kb/doc.php?id=7012027 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.8EPSS: 95%CPEs: 1EXPL: 0CVE-2013-1084 – Novell ZENworks umaninv Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2013-1084
Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename parameter in a GetFile action to zenworks-unmaninv/. Vulnerabilidad de salto de directorio en el método GetFle del servicio umaninv de Novell ZENworks Configuration Management (ZCM) 11.2.3 que permite a atacantes remotos leer archivos de su elección a través de .. (punto punto) en el parámetro Filename en una acción GetFile en zenworks-unmaninv /. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENworks. • http://secunia.com/advisories/55450 http://www.novell.com/support/kb/doc.php?id=7012027 http://www.novell.com/support/kb/doc.php?id=7012760 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6345
https://notcve.org/view.php?id=CVE-2012-6345
Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information. Novell ZENworks Configuration Management versiones anteriores a 11.2.4, permite obtener información de rastreo confidencial. • https://support.microfocus.com/kb/doc.php?id=7012763 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6344
https://notcve.org/view.php?id=CVE-2012-6344
Novell ZENworks Configuration Management before 11.2.4 allows XSS. Novell ZENworks Configuration Management versiones anteriores a 11.2.4, permite un ataque de tipo XSS. • https://support.microfocus.com/kb/doc.php?id=7012761 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0CVE-2013-1093
https://notcve.org/view.php?id=CVE-2013-1093
Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the directToPage parameter. Vulnerabilidad de redirección abierta en la función fwdToURL la pagina de login de ZCC en zcc-framework.jar en Novell ZENworks Configuration Management (ZCM) v11.2 anterior a v11.2.3a Monthly Update 1 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing a través del parámetro directToPage. • http://www.novell.com/support/kb/doc.php?id=7012025 http://www.novell.com/support/kb/doc.php?id=7012027 http://www.novell.com/support/kb/doc.php?id=7012499 • CWE-20: Improper Input Validation •