Vulnerabilities > Landesk
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-09-19 | CVE-2014-5362 | Improper Input Validation vulnerability in Landesk Management Suite 8.7/8.8/9.6 The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to (1) ldms/sm_actionfrm.asp or (2) remote/frm_coremainfrm.aspx; or the (3) top parameter to remote/frm_splitfrm.aspx. | 6.5 |
| 2015-04-21 | CVE-2014-5361 | Cross-Site Request Forgery (CSRF) vulnerability in Landesk Management Suite 8.7/8.8/9.6 Multiple cross-site request forgery (CSRF) vulnerabilities in Landesk Management Suite 9.6 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) start, (2) stop, or (3) restart services via a request to remote/serverServices.aspx. | 6.8 |
| 2015-02-03 | CVE-2014-5360 | Cross-site Scripting vulnerability in Landesk Management Suite 8.7/8.8/9.6 Cross-site scripting (XSS) vulnerability in the admin interface in LANDESK Management Suite before 9.6 SP1 allows remote attackers to inject arbitrary web script or HTML via the AMTVersion parameter to remote/serverlist_grouptree.aspx. | 4.3 |
| 2012-02-18 | CVE-2012-1196 | Path Traversal vulnerability in Landesk Lenovo Thinkmanagement Console 9.0.3 Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. | 5.0 |
| 2012-02-18 | CVE-2012-1195 | Permissions, Privileges, and Access Controls vulnerability in Landesk Lenovo Thinkmanagement Console 9.0.3 Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a PutUpdateFileCore command in a RunAMTCommand SOAP request, then accessing the file via a direct request to the file in the web root. | 7.5 |
| 2010-11-15 | CVE-2010-2892 | Improper Input Validation vulnerability in Landesk Management Gateway gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the DRIVES parameter, as demonstrated by a cross-site request forgery (CSRF) attack. | 8.5 |
| 2009-02-20 | CVE-2008-6195 | Path Traversal vulnerability in Landesk Management Suite 8.7/8.8 Directory traversal vulnerability in the PXE TFTP Service (PXEMTFTP.exe) in LANDesk Management Suite (LDMS) 8.80.1.1 and earlier allows remote attackers to read arbitrary files via a subdirectory name followed by ".." sequences, a different vulnerability than CVE-2008-1643. | 7.8 |
| 2008-09-18 | CVE-2008-2468 | Buffer Errors vulnerability in Landesk products Multiple buffer overflows in the QIP Server Service (aka qipsrvr.exe) in LANDesk Management Suite, Security Suite, and Server Manager 8.8 and earlier allow remote attackers to execute arbitrary code via a crafted heal request, related to the StringToMap and StringSize arguments. | 10.0 |
| 2007-04-18 | CVE-2007-1674 | Buffer Overflow vulnerability in Landesk Management Suite 8.7 Stack-based buffer overflow in the Alert Service (aolnsrvr.exe) in LANDesk Management Suite 8.7 allows remote attackers to execute arbitrary code via a crafted packet to port 65535/UDP. | 10.0 |