CVE-2013-2969

IBM Sterling Control Center (SCC) is affected by CVE-2013-2969 (XSS) in releases 5.2.0.9 and earlier, 5.3.x up to 5.3.0.3, and 5.4 up to 5.4.0.1. The issue allows remote authenticated users to inject arbitrary web script or HTML via vectors involving invalid characters. Remediation is to upgrade ...

Novell ZENworks Control Center File Upload Remote Code Execution (intrusive check)

The installed version of Novell ZENworks Control Center has a flaw with authentication checking on '/zenworks/jsp/index.jsp' that can allow a remote, unauthenticated attacker to upload arbitrary files and execute them with SYSTEM privileges. Nessus has exploited this vulnerability to upload a fil...

Novell ZENworks Control Center file upload vulnerability

Added: 05/03/2013 CVE: CVE-2013-1080 BID: 58668 OSVDB: 91627 Background Novell ZENworks Configuration Management is an IT desktop computer management suite that provides the ability to install, configure and administer desktop computers from a centralized location. The product is based on a...

Novell ZENworks Configuration Management Remote Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 /Apache-Coyote/ include...

Novell ZENworks Control Center File Upload Remote Code Execution

The installed version of Novell ZENworks Control Center has a flaw with authentication checking on '/zenworks/jsp/index.jsp' that can allow a remote, unauthenticated attacker to upload arbitrary files and execute them with SYSTEM privileges. C Tenable Network Security, Inc. include"compat.inc"; i...

Novell ZENworks Control Center File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell ZENworks. Authentication is not required to exploit this vulnerability. The specific issues exists within ZENworks Control Center which listens on tcp/443 by default. Insufficient...

Android Malware that can DDoS Attacks from your smartphone

The Russian anti-virus vendor Doctor Web has found a new malicious program for Android which allows hacker groups to carry out mobile denial of service attacks. While it's not entirely clear how the Trojan is spread, researchers suspect that the attackers use social engineering tactics since the...

KLA10437 RCE vulnerability in AMD Catalyst Control Center

An update spoofing vulnerability was found in AMD CCC. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via spoofing update server. Original advisories Charlie Eriksen AMD advisory Related products AMD-Catalyst-Control-Cente...

Dr. Web Control Center Admin UI Remote Script Code Injection

Dr. Web Control Center Admin UI Remote Script Code Injection ============================================================= Affected Products/Versions -------------------------- Product Name: Dr. Web Enterprise Server Version Number: 6.00.3.201111300 Product/Company Information...

Dr. Web Control Center 6.00.3.201111300 - Cross-Site Scripting

Dr. Web Control Center 6.00.3.201111300 - Cross-Site Scripting Dr. Web Control Center Admin UI Remote Script Code Injection ============================================================= Affected Products/Versions -------------------------- Product Name: Dr. Web Enterprise Server Version Number:...

Dr. Web Control Center 6.00.3.201111300 - Cross-Site Scripting

Dr. Web Control Center Admin UI Remote Script Code Injection ============================================================= Affected Products/Versions -------------------------- Product Name: Dr. Web Enterprise Server Version Number: 6.00.3.201111300 Product/Company Information...

Dr. Web Control Center 6.00.3.201111300 Cross Site Scripting

Dr. Web Control Center Admin UI Remote Script Code Injection ============================================================= Affected Products/Versions -------------------------- Product Name: Dr. Web Enterprise Server Version Number: 6.00.3.201111300 Product/Company Information...

CVE-2012-0301

Session fixation vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2012-0302

Cross-site scripting XSS vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Brightmail Control Center in Symantec Message Filter 6.3 allow remote attackers to hijack the authentication of arbitrary users for requests that 1 execute application commands or 2 create admin accounts...

Session fixation

Session fixation vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to hijack web sessions via unspecified vectors...

CVE-2012-0300

CVE-2012-0300 affects Symantec Message Filter’s Brightmail Control Center/web management interface (Symantec Message Filter 6.3 and prior). Root cause: improper restriction of sessions to the listening port enables remote disclosure of potentially sensitive version information via unspecified vec...

CVE-2012-0303

The CVE-2012-0303 entry applies to Symantec Message Filter’s Brightmail Control Center (web management interface) and describes multiple CSRF vulnerabilities in version 6.3 that allow remote attackers to hijack user authentication for actions such as executing commands or creating an admin accoun...

CVE-2012-0301

Symantec Message Filter’s Brightmail Control Center (web interface) 6.3 is tied to CVE-2012-0301, a session-fixation vulnerability that can allow an attacker to hijack a legitimate user session via unspecified vectors. The linked open-source advisories and vendor notes confirm that this issue aff...