CVE-2014-6262

CVE-2014-6262 describes multiple format string vulnerabilities in the Python RRDtool module used by Zenoss Core (before 4.2.5) and other products. An attacker can exploit a crafted third argument to rrdtool.graph to execute arbitrary code or cause an application crash (DoS). Related to CVE-2013-2...

CVE-2014-9249

The CVE-2014-9249 entry affects Zenoss Core before version 5, where the default configuration exposes services on open ports that allow remote attackers to read or modify database information (ZEN-15408). The connected sources corroborate this description but do not provide concrete remediation d...

CVE-2014-9386

CVE-2014-9386 affects Zenoss Core before 4.2.5 SP161. The issue is an infinite lifetime for the session ID cookie, enabling potential session hijacking by an attacker with access to an unattended workstation. The CVE description notes the root cause is the cookie’s unlimited lifetime, which can l...

CVE-2014-9245

CVE-2014-9245 affects Zenoss Core up to version 5 Beta 3. The vulnerability allows remote attackers to obtain sensitive information by performing a product-rename action with an invalid new name and then reading a stack trace that exposes internal URLs and other sensitive information. The availab...

CVE-2014-6259

Technical details for CVE-2014-6259 (Zenoss Core) are not provided in the connected documents; no product/version/root-cause/impact/fix specifics are present. Monitor for updates.

CVE-2014-6258

CVE-2014-6258 affects Zenoss Core up to 5 Beta 3. The vulnerability is a Denial of Service caused by triggering an arbitrary regular-expression match, enabling remote attackers to consume CPU. The available connected documents confirm the issue as a DoS via user-supplied regex without detailing e...

CVE-2014-9385

CVE-2014-9385: CSRF vulnerability in Zenoss Core up to and including 5 Beta 3 allows remote attackers to hijack user authentication and trigger arbitrary code execution via a ZenPack upload (ZEN-15388).

CVE-2014-9250

CVE-2014-9250 affects Zenoss Core through 5 Beta 3, where the authentication cookie is sent without the HttpOnly flag in Set-Cookie. This exposes credential information to client-side script access, increasing risk of credential exposure. The document notes mitigation by enabling SSL/HTTPS to bet...

CVE-2014-9247

CVE-2014-9247 affects Zenoss Core up to 5 Beta 3, where remote authenticated users can enumerate sensitive data (user accounts, e-mail addresses, and roles) via the ZenUsers (User Manager) page. Root cause details are not provided in the initial description, and exploitation status or patch infor...

CVE-2014-6257

Zenoss Core (through 5 Beta 3) contains a systemic authorization bypass (CVE-2014-6257) that lets remote attackers use a web-endpoint URL to invoke an object helper method, bypassing access restrictions. Affects Zenoss Core 4.x/5 Beta 3; no exploit details are provided in the sources. Remediation...

CVE-2014-6253

CVE-2014-6253 affects Zenoss Core (through Zenoss Core 5 Beta 3). The vulnerability is a cross-site request forgery (CSRF) that could allow a remote attacker to hijack the authentication of arbitrary users. Root cause: CSRF in the Zenoss Core web interface. Impact, as stated in the connected reco...

CVE-2014-9248

CVE-2014-9248 affects Zenoss Core up to 5 Beta 3, with no password complexity requirements, enabling potential remote brute-force access. The issue is tied to the authentication policy, not a specific code path in isolation. The public materials indicate mitigation by applying Zenoss Core 4.2.5 S...

CVE-2014-6254

CVE-2014-6254 refers to multiple cross-site scripting (XSS) vulnerabilities in Zenoss Core up to 5 Beta 3. The NVD description states that remote attackers could inject arbitrary web script or HTML via an attribute in a device name, device detail, report name, report detail, portlet name, or via ...

CVE-2014-9251

Zenoss Core up to 5 Beta 3 uses a weak password-hashing algorithm, enabling context-dependent attackers to obtain plaintext passwords by brute-forcing stored hashes in the database (ZEN-15413). CVSS v2 base score 5.0 (Medium) as per NVD.

CVE-2014-9252

CVE-2014-9252 affects Zenoss Core through 5 Beta 3, where cleartext passwords are stored in the session database. The underlying issue is plaintext password storage in the server-side session store, potentially allowing local users to read sensitive credentials by inspecting database entries. No ...

CVE-2014-6255

CVE-2014-6255 affects Zenoss Core prior to 4.2.5 SP161, with an open redirect in the login form triggered by the came_from parameter. This can enable phishing by redirecting users to arbitrary sites. Remediation: upgrade to Zenoss Core 4.2.5 SP (or later) as indicated by the vendor/update guidanc...

CVE-2014-6260

Zenoss Core up to version 5 Beta 3 contains a page-command editing vulnerability (CVE-2014-6260) that does not require a password to modify the pager command string, enabling remote command execution or a paging outage when an unattended workstation is leveraged. Affected product: Zenoss Core thr...

CVE-2014-6261

Mode C: The CVE-2014-6261 issue affects Zenoss Core up to 5 Beta 3, where the Check For Updates feature allows remote code execution via unpickling of potentially unsafe Python objects during version checks (via spoofed callhome server or visiting a crafted site). The vulnerability arises in the ...

CVE-2014-6256

Zenoss Core through 5 Beta 3 permits an Authorization Bypass via a move action that lets remote attackers bypass access controls and place files in a directory with public (read or execute) permissions, i.e., ZEN-15386. Affected component is the Zenoss Core web/authorization logic related to file...