Novell ZENworks Configuration Management FileViewer Information Disclosure (CVE-2015-0783)

An information disclosure vulnerability exists in Novell ZENworks Configuration Management. The vulnerability is due to lack of sanitization on the filename parameter within the FileViewer class. By sending crafted requests to the target server, a remote attacker can leverage this vulnerability t...

Novell ZENworks Configuration Management DirectoryViewer Information Disclosure (CVE-2015-0785)

An information disclosure vulnerability exists in Novell ZENworks Configuration Management. The vulnerability is due to lack of sanitization of the dirname parameter within the DirectoryViewer class. By sending crafted requests to the target server, a remote attacker can leverage this vulnerabili...

Novell ZENworks Configuration Management Remote Management Component Directory Traversal Vulnerability

Novell ZENworks Configuration Management is a suite of configuration management solutions.Remote Management is a remote management component. A directory traversal vulnerability exists in the UploadServlet in the Remote Management component of Novell ZCM, which can be exploited by a remote attack...

OPM Warned About Vulnerabilities, Governance Weaknesses

It’s hardly a surprise that the U.S. Office of Personnel Management OPM was targeted by nation-state hackers, given the sensitivity of the personal information the office stored. It’s also no shocker that OPM has been successfully infiltrated more than once given the state of its information...

CVE-2015-0779

Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management ZCM 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR...

CVE-2010-5323

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ZCM 10 before 10.3 allows remote attackers to execute arbitrary code via a crafted WAR pathname in the filename parameter in conjunction with WAR content in the POST...

Directory traversal

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ZCM 10 before 10.3 allows remote attackers to execute arbitrary code via a crafted WAR pathname in the filename parameter in conjunction with WAR content in the POST...

Directory traversal

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ZCM 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter, in...

CVE-2010-5324

CVE-2010-5324 is a directory traversal vulnerability in the UploadServlet of the Remote Management component of Novell ZENworks Configuration Management (ZCM) 10.x before 10.3. An attacker can trigger remote code execution by sending a zenworks-fileupload request with a crafted directory name in ...

CVE-2010-5323

CVE-2010-5323 is a directory traversal vulnerability in the UploadServlet of the Remote Management component of Novell ZENworks Configuration Management (ZCM) 10 prior to 10.3. An attacker can remotely execute arbitrary code by crafting a WAR pathname in the filename parameter, paired with WAR co...

CVE-2015-0779

Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management ZCM 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR...

CVE-2015-0779

CVE-2015-0779 affects Novell ZENworks Configuration Management (ZCM) Remote Management UploadServlet in ZCM 10 and 11 prior to 11.3.2. A crafted directory name in the uid parameter, combined with a WAR filename and POST data, enables remote code execution via directory traversal. This is distinct...

CVE-2010-5324

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ZCM 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter, in...

Novell ZenWorks Configuration Management code execution

Code execution via web interface...

Reflected XSS Vulnerability In Manage Engine Firewall Analyzer

======================================================================== =======Reflected XSS Vulnerability In Manage Engine Firewall Analyzer ======================================================================== ======= . contents:: Table Of Content Overview ======== Title : Reflected XSS...

Novell ZENworks Configuration Management Arbitrary File Upload Exploit

Exploit for java platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Novell ZENworks Configuration Management Arbitrary File Upload', 'Description'...

Novell ZENworks Configuration Management < 11.3.2 Remote Code Execution (intrusive check)

The version of Novell ZENworks Configuration Management ZCM running on the remote host is affected by a remote code execution vulnerability due to improper sanitization of user-supplied input to the 'uid' POST parameter in the /zenworks/UploadServlet script. An unauthenticated, remote attacker ca...

Novell ZENworks Configuration Management GetStoredResult.class SQL Injection (CVE-2015-0780)

An SQL injection vulnerability exists in ZENworks Configuration Management. The vulnerability is due to insufficient sanitization of the input parameter in the GetReRequestData method of the GetStoredResult class before it is used in an SQL query. A remote attacker can exploit this vulnerability ...

Novell ZENworks Configuration Management Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Novell ZENworks Configuration Management Arbitrary File Upload', 'Description' = %q This module exploits a file upload vulnerability...

Novell ZENworks Configuration Management Arbitrary File Upload

This module exploits a file upload vulnerability in Novell ZENworks Configuration Management ZCM, which is part of the ZENworks Suite. The vulnerability exists in the UploadServlet which accepts unauthenticated file uploads and does not check the "uid" parameter for directory traversal characters...