Novell
Novell Zenworks Configuration Management: vulnerabilidades y CVE
Novell Zenworks Configuration Management tiene 35 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 6 son críticas y 2 figuran en el catálogo de explotación activa de CISA.
CVE35
Últimos 12 meses0
Críticas6
Explotadas activamente2
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2014-6271 | Crítica (9.8) | 100% | ⚠ Explotación activa | 24 sept 2014 | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by… |
| CVE-2014-7169 | Crítica (9.8) | 100% | ⚠ Explotación activa | 25 sept 2014 | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2012-6345 | Alta (7.5) | 1.1% | — | 25 ene 2020 | Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information. |
| CVE-2012-6344 | Media (6.1) | 0.72% | — | 25 ene 2020 | Novell ZENworks Configuration Management before 11.2.4 allows XSS. |
| CVE-2015-0786 | Crítica (9.8) | 24% | — | 9 ago 2017 | Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary code via unspecified vectors. |
| CVE-2015-0785 | Alta (7.5) | 6.5% | — | 9 ago 2017 | com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders via the dirname variable. |
| CVE-2015-0784 | Alta (7.5) | 6.6% | — | 9 ago 2017 | Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable. |
| CVE-2015-0783 | Media (6.5) | 5.0% | — | 9 ago 2017 | The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the filename variable. |
| CVE-2015-0782 | Crítica (9.8) | 7.1% | — | 9 ago 2017 | SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2015-0781 | Crítica (9.8) | 4.3% | — | 9 ago 2017 | Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload and execute arbitrary files via unspecified vectors. |
| CVE-2015-0780 | Crítica (9.8) | 8.2% | — | 9 ago 2017 | SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2015-5970 | Media (5.3) | 1.3% | — | 18 feb 2016 | The ChangePassword RPC method in Novell ZENworks Configuration Management (ZCM) 11.3 and 11.4 allows remote attackers to conduct XPath injection attacks, and read arbitrary text files, via a malformed query involving a… |
| CVE-2015-0779 | Alta (10) | 74% | — | 7 jun 2015 | Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid… |
| CVE-2010-5324 | Alta (10) | 72% | — | 7 jun 2015 | Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a… |
| CVE-2010-5323 | Alta (10) | 14% | — | 7 jun 2015 | Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a crafted WAR… |
| CVE-2014-7169 | Crítica (9.8) | 100% | ⚠ Explotación activa | 25 sept 2014 | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown… |
| CVE-2014-6271 | Crítica (9.8) | 100% | ⚠ Explotación activa | 24 sept 2014 | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by… |
| CVE-2013-3706 | Media (5) | 7.6% | — | 6 mar 2014 | Directory traversal vulnerability in the PreBoot service in Novell ZENworks Configuration Management (ZCM) 11.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a preboot update pathname, aka… |
| CVE-2013-6347 | Media (6.8) | 1.2% | — | 2 nov 2013 | Session fixation vulnerability in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack web sessions via unspecified vectors. |
| CVE-2013-6346 | Media (6.8) | 0.58% | — | 2 nov 2013 | Cross-site request forgery (CSRF) vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows remote attackers to hijack the authentication of unspecified victims via unknown… |
| CVE-2013-6345 | Alta (10) | 1.5% | — | 2 nov 2013 | Unspecified vulnerability in the ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 has unknown impact and attack vectors related to an "Application Exception." |
| CVE-2013-6344 | Media (4.3) | 0.90% | — | 2 nov 2013 | The ZCC page in Novell ZENworks Configuration Management (ZCM) before 11.2.4 allows attackers to conduct cross-frame scripting attacks via unknown vectors. |
| CVE-2013-1084 | Media (5) | 5.7% | — | 2 nov 2013 | Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename… |
| CVE-2013-1097 | Media (4.3) | 1.3% | — | 17 jun 2013 | Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML… |
| CVE-2013-1095 | Media (4.3) | 1.3% | — | 17 jun 2013 | Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML… |
| CVE-2013-1094 | Media (4.3) | 1.3% | — | 17 jun 2013 | Cross-site scripting (XSS) vulnerability in a ZCC page in zenworks-core in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or… |
| CVE-2013-1093 | Media (5.8) | 1.3% | — | 17 jun 2013 | Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect… |
| CVE-2013-1080 | Alta (10) | 77% | — | 29 mar 2013 | The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory… |
| CVE-2013-1079 | Media (6.8) | 2.4% | — | 29 mar 2013 | Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote… |
| CVE-2011-3174 | Media (6.8) | 2.9% | — | 26 jul 2012 | Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote… |
| CVE-2011-2658 | Media (6.8) | 2.7% | — | 26 jul 2012 | The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 provides access to the mscomct2.ocx file, which allows remote attackers to execute arbitrary code… |
| CVE-2011-2657 | Media (6.8) | 48% | — | 26 jul 2012 | Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Novell
Suse Linux Enterprise Server · 91Suse Linux Enterprise Desktop · 83Groupwise · 75Netware · 72Suse Linux Enterprise Software Development KIT · 65Edirectory · 51Suse Linux Enterprise Real Time Extension · 33Iprint · 30Suse Linux Enterprise Debuginfo · 24Suse Linux Enterprise Workstation Extension · 24Suse Linux Enterprise Live Patching · 22Suse Linux Enterprise Module FOR Public Cloud · 22