Cross site scripting

Cross-site scripting XSS vulnerability in a ZCC page in zenworks-core in Novell ZENworks Configuration Management ZCM 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via an invalid locale...

CVE-2013-1093

The CVE-2013-1093 entry concerns an open redirect in the ZENworks Configuration Management (ZCM) 11.2 line, specifically the fwdToURL function on the ZENworks Control Center (ZCC) login page (zcc-framework.jar). The root cause is improper validation of the directToPage parameter, enabling remote ...

CVE-2013-1094

CVE-2013-1094 is an XSS vulnerability in the ZENworks Configuration Management (ZCM) 11.2 line, specifically in the ZENworks Control Center/zenworks-core ZCC page. The issue arises from improper validation of an invalid locale, allowing remote attackers to inject arbitrary JavaScript/HTML. Public...

CVE-2013-1097

CVE-2013-1097 is an XSS vulnerability affecting Novell ZENworks Configuration Management (ZCM) 11.2 prior to 11.2.3a Monthly Update 1, in the njwc.jar ZCC page. The vulnerability allows remote attackers to inject arbitrary web script or HTML via vectors involving an onload event. There is no expl...

CVE-2013-1079

CVE-2013-1079 relates to a directory traversal vulnerability in the ISCreateObject method of the ISProxy ActiveX object used by Novell ZENworks AdminStudio (ISProxy.dll). The flaw, triggered by a crafted web page that also calls Initialize, can cause the underlying OS to load arbitrary local DLLs...

CVE-2013-1080

The web server in Novell ZENworks Configuration Management ZCM 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a reque...

CVE-2013-1080

CVE-2013-1080 affects Novell ZENworks Configuration Management 10.3 and 11.2 prior to 11.2.4. The vulnerability arises from improper authentication for zenworks/jsp/index.jsp, enabling directory traversal and upload/execution of arbitrary programs via TCP port 443. Public references and connected...

CVE-2011-2657

Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management ZCM 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a pathname in the firs...

Design/Logic Flaw

The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management ZCM 10.2, 10.3, and 11 SP1 provides access to the mscomct2.ocx file, which allows remote attackers to execute arbitrary code by leveraging unspecified mscomct2 flaws...

CVE-2011-3174

The CVE-2011-3174 issue affects Novell ZENworks Configuration Management (AdminStudio) via the ISGrid2.dll/InstallShield ISGrid2 ActiveX control. A buffer overflow in DoFindReplace triggered by a long bstrReplaceText parameter allows remote code execution. Reported in versions 10.2, 10.3, and 11 ...

CVE-2011-2657

CVE-2011-2657 affects the AdminStudio LaunchHelp.dll ActiveX control (LaunchHelp.HelpLauncher.1) used by Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1. The vulnerability arises in the LaunchProcess() function where a directory traversal string supplied as the first argumen...

CVE-2012-2223

The CVE-2012-2223 issue affects Novell ZENworks Configuration Management (ZCM): the xplat agent in ZCM 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which could allow remote attackers to perform cross-site tracing (XST) via unspecified vectors. Impact is stated as poten...

CVE-2012-2215

CVE-2012-2215 describes a directory traversal in the ZENworks Configuration Management Preboot Service (12.x files reference show Preboot opcode 0x21) that allows remote read of arbitrary files. The public details indicate the vulnerability exists in ZCM 11.1 and 11.1a, with exploitation via an o...

Novell ZENworks Configuration Management Preboot Service Opcode 4c Vulnerability

Added: 03/28/2012 CVE: CVE-2011-3176 BID: 52659 OSVDB: 80231 Background Novell ZENworks Configuration Management is an IT desktop computer management suite that provides the ability to install, configure and administer desktop computers from a centralized location. The product is based on a...

Novell ZENworks Configuration Management Preboot Service Opcode 4c Vulnerability

Added: 03/28/2012 CVE: CVE-2011-3176 BID: 52659 OSVDB: 80231 Background Novell ZENworks Configuration Management is an IT desktop computer management suite that provides the ability to install, configure and administer desktop computers from a centralized location. The product is based on a...

Novell ZENworks Configuration Management < 10 SP3 Multiple Flaws

ZENworks Configuration Management, a configuration management software from Novell, is installed on the remote Windows host. According to its version, it is affected by several vulnerabilities : - An unspecified vulnerability in ZCM Preboot Service may allow an attacker to execute arbitrary code ...