Cross site scripting

Cross-site scripting XSS vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the title of a device...

CVE-2014-3738

CVE-2014-3738 affects Zenoss Core 4.2.5-2108 (64-bit). The issue is a Stored XSS vulnerability triggered via the title field of a device, allowing an attacker to inject arbitrary scripts/HTML when users view the affected device. Multiple linked sources (exploit DB, packetstorm, and related adviso...

CVE-2014-3739

Zenoss 4.2.5 is affected by an open redirect in zport/acl_users/cookieAuthHelper/login_form, allowing an attacker to redirect users to arbitrary sites via the came_from parameter. The issue originates from improper handling of the came_from input, enabling phishing-like redirections. No explicit ...

CVE-2014-3739

Open redirect vulnerability in zport/aclusers/cookieAuthHelper/loginform in Zenoss 4.2.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the camefrom parameter...

CVE-2014-3738

Cross-site scripting XSS vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the title of a device...

[oss-security] Zenoss Open Source monitoring System - Open Redirect & Stored XSS Vulnerabilities

hi, Several security issues were found in Zenoss monitoring system. 1. Stored XSS. A persistent XSS vulnerability was found in Zenoss core, by creating a malicious host with the Title scriptalert"Xss"/script any user browsing to the relevant manufacturers page will get a client-side script execut...

Zenoss 3 - showDaemonXMLConfig Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Zenoss 3...

Zenoss 3 showDaemonXMLConfig Command Execution

Exploit for unix platform in category remote exploits 0day.today 2018-01-03...

Zenoss 3 showDaemonXMLConfig Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Zenoss 3...

Zenoss 3 showDaemonXMLConfig Command Execution

This module exploits a command execution vulnerability in Zenoss 3.x which could be abused to allow authenticated users to execute arbitrary code under the context of the 'zenoss' user. The showdaemonxmlconfigs function in the 'ZenossInfo.py' script calls Popen with user controlled data from the...

Zenoss 3.2.1 - (Authenticated) Remote Command Execution

Zenoss 3.2.1 - Authenticated Remote Command Execution source: https://www.securityfocus.com/bid/54793/info Zenoss is prone to the following security vulnerabilities: 1. Multiple arbitrary command-execution vulnerabilities 2. Multiple HTML-injection vulnerabilities 3. An open-redirection...

Zenoss 3.2.1 - (Authenticated) Remote Command Execution

source: https://www.securityfocus.com/bid/54793/info Zenoss is prone to the following security vulnerabilities: 1. Multiple arbitrary command-execution vulnerabilities 2. Multiple HTML-injection vulnerabilities 3. An open-redirection vulnerability 4. Multiple directory-traversal vulnerabilities 5...

Zenoss 3.2.1 - Multiple Vulnerabilities

Zenoss 3.2.1 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/54793/info Zenoss is prone to the following security vulnerabilities: 1. Multiple arbitrary command-execution vulnerabilities 2. Multiple HTML-injection vulnerabilities 3. An open-redirection vulnerability 4. Multip...

Zenoss 3.2.1 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/54793/info Zenoss is prone to the following security vulnerabilities: 1. Multiple arbitrary command-execution vulnerabilities 2. Multiple HTML-injection vulnerabilities 3. An open-redirection vulnerability 4. Multiple directory-traversal vulnerabilities 5...

Zenoss Server Version Detection

This script detects the installed version of Zenoss Server and sets the result in KB. OpenVAS Vulnerability Test $Id: gbzenossservdetect.nasl 6065 2017-05-04 09:03:08Z teissa $ Zenoss Server Version Detection Authors: Rachana Shetty Copyright: Copyright c 2010 Greenbone Networks GmbH,...

Zenoss Server Multiple Vulnerabilities

The host is running Zenoss Server and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbzenossservmultvuln.nasl 5388 2017-02-21 15:13:30Z teissa $ Zenoss Server Multiple Vulnerabilities Authors: Rachana Shetty Copyright: Copyright c 2010 SecPod, http://www.secpod.com This...

Zenoss Server Detection (HTTP)

HTTP based detection of Zenoss Server. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.800988";...

Zenoss Server Multiple Vulnerabilities

Zenoss Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:zenoss:zenoss"; ifdescription...

CVE-2010-0712

Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the 1 severity, 2 state, 3 filter, 4 offset, and 5 count parameters...

CVE-2010-0713

Multiple cross-site request forgery CSRF vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for 1 requests that reset user passwords via zport/dmd/ZenUsers/admin, and 2 requests that change user commands, which...