The vulnerability of the doPost method in the Rtrlet class of the ZENworks Configuration Management information system allows a perpetrator to load and execute arbitrary files.

The vulnerability of the GetReRequestData method in the GetStoredResult class of the ZENworks Configuration Management information system is related to the failure to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands using...

CVE-2015-0781: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management ZCM allows remote attackers to upload and execute arbitrary files via unspecified vectors...

Novell ZENworks 'doPost' Method Remote Code Execution Vulnerability

Novell ZENworks is a suite of software that supports automated IT management and business process management across resources within an organization. The 'doPost' method in the Rtrlet class of Novell ZENworks fails to adequately filter the path of an uploaded file, allowing remote attackers to...

BuildEdgeIndexServlet XSRF

The BuildEdgeIndexServlet is responsible for rebuilding the edge index. As this is a servlet and not a Webwork action, XSRF checks must be implemented programmatically. The Servlet does not currently implement any XSRF token checks, meaning the edge index can be forced to be rebuilt when attacked...

CVE-2011-0276: Undefined Security Weakness

HP OpenView Performance Insight Server 5.2, 5.3, 5.31, 5.4, and 5.41 contains a "hidden account" in the com.trinagy.security.XMLUserManager Java class, which allows remote attackers to execute arbitrary code via the doPost method in the com.trinagy.servlet.HelpManagerServlet class...

PT-2011-2250

Name of the Vulnerable Software and Affected Versions HP OpenView Performance Insight Server versions 5.2 through 5.41 Description The issue concerns a hidden account in the com.trinagy.security.XMLUserManager Java class, allowing remote attackers to execute arbitrary code via the doPost method i...

Information disclosure

MailWasher Server before 2.2.1, when used with LDAP or Active Directory AD, does not properly handle blank passwords, which allows remote attackers to access an arbitrary user account and read the spam e-mail messages stored for that account, possibly related to the LoginCheck::doPost function in...

CVE-2007-3275

MailWasher Server before 2.2.1, when used with LDAP or Active Directory AD, does not properly handle blank passwords, which allows remote attackers to access an arbitrary user account and read the spam e-mail messages stored for that account, possibly related to the LoginCheck::doPost function in...

CVE-2007-3275: Undefined Security Weakness

MailWasher Server before 2.2.1, when used with LDAP or Active Directory AD, does not properly handle blank passwords, which allows remote attackers to access an arbitrary user account and read the spam e-mail messages stored for that account, possibly related to the LoginCheck::doPost function in...