Novell ZENworks Configuration Management schedule.ScheduleQuery SQL Injection (CVE-2015-0782)

An SQL injection vulnerability exists in ZENworks Configuration Management. The vulnerability is due to insufficient sanitization of a request parameter in the run method of the ScheduleQuery class before using the parameter in SQL queries. A remote, unauthenticated attacker can exploit this...

Novell ZENworks Configuration Management Preboot Policy Service Buffer Overflow (CVE-2015-0786)

A stack buffer overflow vulnerability exists in the PreBoot Policy Service of Novell ZENworks Configuration Management. The vulnerability is due to a boundary error in the logging functionality. Remote, unauthenticated attackers could exploit this vulnerability by sending crafted packets to the...

Endian Firewall 3.0.0 - OS Command Injection (Metasploit)

Endian Firewall 3.0.0 - OS Command Injection Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 'Endian Firewall %q This module exploits an OS command injection vulnerabilit...

Novell ZENworks Configuration Management Session ID Information Disclosure (CVE-2015-0784)

An information disclosure vulnerability exists in Novell ZENworks Configuration Management. The vulnerability is due to exposure of insecure functionality within Rtrlet.class. A remote unauthenticated attacker can leverage this vulnerability to disclosure Session IDs of the logged in users which...

The vulnerability of the ZENworks Configuration Management software allows a perpetrator to execute arbitrary code.

The vulnerability of the ZENworks Configuration Management information system exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially crafted directory name specified ...

Novell ZENworks Mobile Management Cross-Site Scripting Vulnerability

Novell ZENworks Mobile Management is a mobile device management solution. A cross-site scripting vulnerability in the Novell ZENworks Mobile Management login form allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that, when viewed with malicious data,...

Novell ZENworks Mobile Management Cross Site Scripting

ZENWorks Mobile Management suffers from cross site scripting vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

[SYSS-2015-020] ZENWorks Mobile Management - Cross-Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-020 Products: ZENWorks Mobile Management Vendor: Novell Affected Versions: 3.1.0 Tested Versions: 3.1.0 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Open Vendor Notification: 2015-04-21...

ZENWorks Mobile Management 3.1.0 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-020 Products: ZENWorks Mobile Management Vendor: Novell Affected Versions: 3.1.0 Tested Versions: 3.1.0 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Open Vendor Notification: 2015-04-21...

Novell ZENworks Configuration Management FileViewer Information Disclosure (CVE-2015-0783)

An information disclosure vulnerability exists in Novell ZENworks Configuration Management. The vulnerability is due to lack of sanitization on the filename parameter within the FileViewer class. By sending crafted requests to the target server, a remote attacker can leverage this vulnerability t...

Novell ZENworks Configuration Management Remote Management Component Directory Traversal Vulnerability

Novell ZENworks Configuration Management is a suite of configuration management solutions.Remote Management is a remote management component. A directory traversal vulnerability exists in the UploadServlet in the Remote Management component of Novell ZCM, which can be exploited by a remote attack...

Novell ZENworks Configuration Management DirectoryViewer Information Disclosure (CVE-2015-0785)

An information disclosure vulnerability exists in Novell ZENworks Configuration Management. The vulnerability is due to lack of sanitization of the dirname parameter within the DirectoryViewer class. By sending crafted requests to the target server, a remote attacker can leverage this vulnerabili...

CVE-2015-0779

Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management ZCM 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR...

CVE-2010-5324

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ZCM 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter, in...

CVE-2010-5323

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ZCM 10 before 10.3 allows remote attackers to execute arbitrary code via a crafted WAR pathname in the filename parameter in conjunction with WAR content in the POST...

Directory traversal

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ZCM 10 before 10.3 allows remote attackers to execute arbitrary code via a crafted WAR pathname in the filename parameter in conjunction with WAR content in the POST...

Directory traversal

Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management ZCM 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter, in...

CVE-2010-5323

CVE-2010-5323 is a directory traversal vulnerability in the UploadServlet of the Remote Management component of Novell ZENworks Configuration Management (ZCM) 10 prior to 10.3. An attacker can remotely execute arbitrary code by crafting a WAR pathname in the filename parameter, paired with WAR co...

CVE-2015-0779

Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management ZCM 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR...

CVE-2015-0779

CVE-2015-0779 affects Novell ZENworks Configuration Management (ZCM) Remote Management UploadServlet in ZCM 10 and 11 prior to 11.3.2. A crafted directory name in the uid parameter, combined with a WAR filename and POST data, enables remote code execution via directory traversal. This is distinct...