CVE-2006-6450

Concrete details found: PatchLink Update Server (basis for Novell ZENworks Patch Management) is affected by CVE-2006-6450. The vulnerability lies in dagent/downloadreport.asp where unsanitized input for the parameters agentid and pass is used to construct SQL queries. This allows an unauthenticat...

CVE-2006-6450: Undefined Security Weakness

Multiple SQL injection vulnerabilities in dagent/downloadreport.asp in Novell ZENworks Patch Management ZPM before 6.3.2.700 allow remote attackers to execute arbitrary SQL commands via the 1 agentid and 2 pass parameters...

CVE-2006-3425: Undefined Security Weakness

FastPatch for a PatchLink Update Server PLUS before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and b Novell ZENworks 6.2 SR1 and earlier, does not require authentication for dagent/proxyreg.asp, which allows remote attackers to list, add, or delete PatchLink Distribution Point PDP proxy servers via...

CVE-2006-3426: Undefined Security Weakness

Directory traversal vulnerability in a PatchLink Update Server PLUS before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and b Novell ZENworks 6.2 SR1 and earlier allows remote attackers to overwrite arbitrary files and directories via a .. dot dot sequence in the 1 action, 2 agentid, or 3 index parameters ...