CVE-2014-9249

The CVE-2014-9249 entry affects Zenoss Core before version 5, where the default configuration exposes services on open ports that allow remote attackers to read or modify database information (ZEN-15408). The connected sources corroborate this description but do not provide concrete remediation d...

CVE-2014-6256

Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public 1 read or 2 execute access via a move action, aka ZEN-15386...

CVE-2014-6259

Technical details for CVE-2014-6259 (Zenoss Core) are not provided in the connected documents; no product/version/root-cause/impact/fix specifics are present. Monitor for updates.

CVE-2014-9252

Zenoss Core through 5 Beta 3 stores cleartext passwords in the session database, which might allow local users to obtain sensitive information by reading database entries, aka ZEN-15416...

CVE-2014-6258

CVE-2014-6258 affects Zenoss Core up to 5 Beta 3. The vulnerability is a Denial of Service caused by triggering an arbitrary regular-expression match, enabling remote attackers to consume CPU. The available connected documents confirm the issue as a DoS via user-supplied regex without detailing e...

CVE-2014-7980

Multiple cross-site scripting XSS vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skiplinktext setting and unspecified...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skiplinktext setting and unspecified...

CVE-2014-7980

Multiple cross-site scripting XSS vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skiplinktext setting and unspecified...

CVE-2014-7980

Zen theme for Drupal 7.x is affected by CVE-2014-7980, with multiple XSS vulnerabilities in template.php. The issues allow remote authenticated users with the administer themes permission to inject arbitrary script/HTML via skip_link_text and other theme settings. Affected versions: Zen 7.x-5.x b...

Zen Cart 1.5.3 - Multiple Vulnerabilities

No description provided by source. Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id...

Zen Cart 1.5.3 - Multiple Vulnerabilities

Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id. localhost/zen/zen-cart-v1.5.3-07042014/admin123/profiles.php?action=delete&profile=2 - Reset layou...

Studio Zen - Multiple Script Direct Request Path Disclosure

The studiozen WordPress theme was affected by a Multiple Script Direct Request Path Disclosure security vulnerability...

WordPress Studio Zen Theme - Multiple Vulnerabilities

The attack vector requires separate vulnerability at target site to conduct CS and XSS attacks with using of jPlayer. Also, there are a full path disclosure vulnerability in this theme. Solution Update the theme...

Zen Cart 1.5.3 - CSRF & Admin Panel XSS

Exploit for php platform in category web applications Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id...

Zen Cart 1.3.9h Local File Inclusion Vulnerability

No description provided by source. Zen Cart 1.3.9h Local File Inclusion Vulnerability Name Zen Cart Vendor http://www.zen-cart.com Versions Affected 1.3.9h Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-11-03 X. IND...

Zen Time Tracking 2.2 Multiple SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/38153/info Zen Time Tracking is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker...

Zen Cart 2008 - index.php keyword Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/29020/info Zen Cart is prone to a cross-site scripting vulnerability and an SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an...

Zen Cart 1.3.9f (typefilter) - Local File Inclusion Vulnerability

No description provided by source. Zen Cart v1.3.9f typefilter Local File Inclusion Vulnerability Vendor: Zen Ventures, LLC Product web page: http://www.zen-cart.com Version affected: 1.3.9f Summary: Zen Cart is an online store management system. It is PHP-based, using a MySQL database and HTML...

Zen Cart 1.3.8 - Remote Code Execution Exploit

No description provided by source. !/usr/bin/php ?php ------- Zen Cart 1.3.8 Remote Code Execution http://www.zen-cart.com/ Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone! A new version 1.3.8a is avaible on http://www.zen-cart.com/ BlackH : errorreportingEALL ^...

Zen Cart 1.3.8 - Remote SQL Execution Exploit

No description provided by source. !/usr/bin/python ------- Zen Cart 1.3.8 Remote SQL Execution http://www.zen-cart.com/ Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone! A new version 1.3.8a is avaible on http://www.zen-cart.com/ BlackH : Notes: must have...