CVE-2014-9247: Exposure of Sensitive Information to an Unauthorized Actor

Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive 1 user account, 2 e-mail address, and 3 role information by visiting the ZenUsers aka User Manager page, aka ZEN-15389...

PT-2014-8901

Name of the Vulnerable Software and Affected Versions Zenoss Core versions through 5 Beta 3 Description The issue allows remote authenticated users to obtain sensitive information, including user account, e-mail address, and role information, by visiting the ZenUsers also known as User Manager...

Zenoss 2.3.3 Multiple Cross Site Request Forgery Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/37843/info Zenoss is prone to multiple cross-site request-forgery vulnerabilities. Exploiting these issues may allow a remote attacker to perform certain administrative actions, execute arbitrary commands, gain unauthoriz...

CVE-2010-0713: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for 1 requests that reset user passwords via zport/dmd/ZenUsers/admin, and 2 requests that change user commands, which...