Vulnerabilities

Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.23643 Published 2017-08-09 No fix listed CWE-119

TI-2015-00733 CVE-2015-0785 · GHSA-854h-gmvf-x57p

com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks…

MEDIUM 42

com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders via the dirname variable.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0652 Published 2017-08-09 No fix listed CWE-200

TI-2015-00732 CVE-2015-0784 · GHSA-55m2-m4jf-3wm8

Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to…

MEDIUM 42

Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0659 Published 2017-08-09 No fix listed CWE-200

TI-2015-00731 CVE-2015-0783 · GHSA-53cv-x4gp-67j7

The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote…

LOW 37

The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the filename variable.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.04965 Published 2017-08-09 No fix listed CWE-200

TI-2015-00730 CVE-2015-0782 · GHSA-8q9q-68wf-88g9

SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell…

MEDIUM 52

SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0708 Published 2017-08-09 No fix listed CWE-89

TI-2015-00729 CVE-2015-0781 · GHSA-wwj5-m94m-cj5c

Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell…

MEDIUM 49

Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload and execute arbitrary files via unspecified vectors.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.04282 Published 2017-08-09 No fix listed CWE-22

TI-2015-00728 CVE-2015-0780 · GHSA-w5cp-gh54-jfjq

SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class…

MEDIUM 53

SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.08217 Published 2017-08-09 No fix listed CWE-89

TI-2015-05058 CVE-2015-5970 · GHSA-79wq-fqm7-crqp

The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and…

LOW 27

The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a s…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01272 Published 2016-02-18 No fix listed CWE-94

TI-2015-00727 CVE-2015-0779 · GHSA-49r7-w8p8-xgc3

Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration…

HIGH 81

Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid param…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.74366 Published 2015-06-07 No fix listed CWE-22

TI-2010-05021 CVE-2010-5324 · GHSA-9mwj-265r-f2gr

Directory traversal vulnerability in UploadServlet in the Remote Management component in…

HIGH 81

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-file…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.71844 Published 2015-06-07 No fix listed CWE-22

TI-2010-05020 CVE-2010-5323 · GHSA-3pg8-3336-w32h

Directory traversal vulnerability in UploadServlet in the Remote Management component in…

MEDIUM 58

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.14357 Published 2015-06-07 No fix listed CWE-22

TI-2014-05975 CVE-2014-7169 · GHSA-f7j6-xrjp-vffg

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed…

CRITICAL 100KEV

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown oth…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.9994 Published 2014-09-25 Fixed CWE-78

TI-2014-05157 CVE-2014-6271 · GHSA-6hfc-grwp-2p9c

GNU Bash through 4.3 processes trailing strings after function definitions in the values…

CRITICAL 100KEV

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vec…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2014-09-24 Fixed CWE-78

TI-2013-03232 CVE-2013-3706 · GHSA-pg6v-35j6-x9ww

Directory traversal vulnerability in the PreBoot service in Novell ZENworks Configuration…

LOW 33

Directory traversal vulnerability in the PreBoot service in Novell ZENworks Configuration Management (ZCM) 11.2 allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07615 Published 2014-03-06 No fix listed CWE-22

TI-2013-05315 CVE-2013-6347 · GHSA-v2jj-9r5f-v99r

Session fixation vulnerability in Novell ZENworks Configuration Management (ZCM) before…

LOW 33

Session fixation vulnerability in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack web sessions via unspecified vectors.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01241 Published 2013-11-02 No fix listed CWE-287

TI-2013-05314 CVE-2013-6346 · GHSA-44h4-8p63-w343

Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks…

LOW 31

Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vect…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00576 Published 2013-11-02 No fix listed CWE-352

TI-2013-05313 CVE-2013-6345 · GHSA-whwc-vxh5-925c

Unspecified vulnerability in the ZCC page in Novell ZENworks Configuration Management…

MEDIUM 46

Unspecified vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 has unknown impact and attack vectors related to an "Application Exception."

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.01451 Published 2013-11-02 No fix listed

TI-2013-05312 CVE-2013-6344 · GHSA-995p-5w7x-w52w

The ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows…

LOW 22

The ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows attackers to conduct cross-frame scripting attacks via unknown vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00895 Published 2013-11-02 No fix listed CWE-79

TI-2013-00938 CVE-2013-1084 · GHSA-5x35-7w5r-q6p9

Directory traversal vulnerability in the GetFle method in the umaninv service in Novell…

LOW 31

Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.05676 Published 2013-11-02 No fix listed CWE-22

TI-2013-00950 CVE-2013-1097 · GHSA-rf46-8mxq-53gg

Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks…

LOW 23

Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01282 Published 2013-06-17 No fix listed CWE-79

TI-2013-00948 CVE-2013-1095 · GHSA-p8mm-3c7c-h938

Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks…

LOW 23

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01282 Published 2013-06-17 No fix listed CWE-79

TI-2013-00947 CVE-2013-1094 · GHSA-qrgp-2697-pwjm

Cross-site scripting (XSS) vulnerability in a ZCC page in zenworks-core in Novell…

LOW 23

Cross-site scripting (XSS) vulnerability in a ZCC page in zenworks-core in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTM…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01282 Published 2013-06-17 No fix listed CWE-79

TI-2013-00946 CVE-2013-1093 · GHSA-2476-32c9-5mv4

Open redirect vulnerability in the fwdToURL function in the ZCC login page in…

LOW 29

Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect u…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01303 Published 2013-06-17 No fix listed CWE-20