Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the usernewmaster parameter to the adminconsole/ URI...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the 1 DBCONN, 2 DBNAME, 3 DMHOST, 4 MANDBNAME, 5 framecmd, 6 identifier, 7 merant.adm.adapters.AdmDialogPropertyMgr, 8...

CVE-2014-0335

Serena Dimensions CM 12.2 Build 7.199.0 web client contains multiple cross-site scripting vulnerabilities (CWE-79). Exploitable via unauthenticated vectors in parameters such as DB_CONN, DB_NAME, DM_HOST, MAN_DB_NAME, framecmd, identifier, merant.adm.adapters.AdmDialogPropertyMgr, nav_frame, nav_...

CVE-2014-0336

The CVE-2014-0336 issue affects Serena Dimensions CM 12.2 Build 7.199.0 web client (and possibly earlier) and is caused by a cross-site request forgery (CSRF) vulnerability in the web client. An attacker can craft a malicious URI to perform actions in an administrator’s session via the user_new_m...

CVE-2014-0335

Multiple cross-site scripting XSS vulnerabilities in the web client in Serena Dimensions CM 12.2 build 7.199.0 allow remote attackers to inject arbitrary web script or HTML via the 1 DBCONN, 2 DBNAME, 3 DMHOST, 4 MANDBNAME, 5 framecmd, 6 identifier, 7 merant.adm.adapters.AdmDialogPropertyMgr, 8...

CVE-2014-0336

Cross-site request forgery CSRF vulnerability in the web client in Serena Dimensions CM 12.2 build 7.199.0 allows remote attackers to hijack the authentication of administrators for requests that use the usernewmaster parameter to the adminconsole/ URI...

Serena Dimensions CM 12.2 Build 7.199.0 web client vulnerabilities

Overview Serena Dimensions CM 12.2 Build 7.199.0 web client and possibly earlier versions contains multiple cross-site scripting vulnerabilities. Description Serena Dimensions CM 12.2 Build 7.199.0 web client and possibly earlier versions contains multiple cross-site scripting...

Serena Dimensions CM Desktop Client does not validate the server SSL certificate

Application: Serena Dimensions CM Affected versions: 10.1 and later Vulnerability: man-in-the-middle attacks Problem type: remote Problem description: ==================== The client/server connection can be SSL encrypted by setting "-ssl" in the listener.dat. The problem is that the Desktop clie...

Serena Dimensions CM cryptographic vulnerability

Server certificate is not validated by client...

CVE-2004-2563

Serena TeamTrack 6.1.1 allows remote attackers to obtain sensitive information such as user names, versions, and database information, and conduct cross-site scripting XSS attacks, via a direct request to tmtrack.dll with modified LoginPage and Template parameters...

CVE-2004-2563

CVE-2004-2563 concerns Serena TeamTrack 6.1.1, where a direct request to tmtrack.dll with modified LoginPage and Template parameters allows remote attackers to disclose sensitive information (user names, versions, database details) and perform cross-site scripting (XSS). The description specifies...

CVE-2004-2563

Serena TeamTrack 6.1.1 allows remote attackers to obtain sensitive information such as user names, versions, and database information, and conduct cross-site scripting XSS attacks, via a direct request to tmtrack.dll with modified LoginPage and Template parameters...

Serena TeamTrack 6.1.1 - Remote Authentication Bypass

source: https://www.securityfocus.com/bid/10770/info It has been reported that Serena TeamTrack is affected by remote authentication bypass vulnerability. This issue is due to a design error that allows unauthenticated users to access sensitive scripts. Successful exploitation of this issue will...

[NT] Serena Software's TeamTrack Sensitive Content Disclosure

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...