Vulnerabilities > Novell > Zenworks Configuration Management
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2013-06-17 | CVE-2013-1094 | Cross-Site Scripting vulnerability in Novell Zenworks Configuration Management Cross-site scripting (XSS) vulnerability in a ZCC page in zenworks-core in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via an invalid locale. | 4.3 |
| 2013-06-17 | CVE-2013-1093 | Improper Input Validation vulnerability in Novell Zenworks Configuration Management Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the directToPage parameter. | 5.8 |
| 2013-03-29 | CVE-2013-1080 | Improper Authentication vulnerability in Novell Zenworks Configuration Management 10.3/11.2 The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443. | 10.0 |
| 2013-03-29 | CVE-2013-1079 | Path Traversal vulnerability in Novell Zenworks Configuration Management Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method. | 6.8 |
| 2012-07-26 | CVE-2011-3174 | Buffer Errors vulnerability in Novell Zenworks Configuration Management 10.2/10.3/11 Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary code via a long bstrReplaceText parameter. | 6.8 |
| 2012-07-26 | CVE-2011-2658 | Permissions, Privileges, and Access Controls vulnerability in Novell Zenworks Configuration Management 10.2/10.3/11 The ISList.ISAvi ActiveX control in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 provides access to the mscomct2.ocx file, which allows remote attackers to execute arbitrary code by leveraging unspecified mscomct2 flaws. | 6.8 |
| 2012-07-26 | CVE-2011-2657 | Path Traversal vulnerability in Novell Zenworks Configuration Management 10.2/10.3/11 Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a pathname in the first argument. | 6.8 |
| 2012-04-11 | CVE-2012-2223 | Information Exposure vulnerability in Novell Zenworks Configuration Management The xplat agent in Novell ZENworks Configuration Management (ZCM) 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing (XST) attacks via unspecified vectors. | 4.3 |
| 2012-04-09 | CVE-2012-2215 | Path Traversal vulnerability in Novell Zenworks Configuration Management 11.1/11.1A Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request. | 5.0 |
| 2012-04-09 | CVE-2011-3176 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Novell Zenworks Configuration Management 11.1/11.1A Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request. | 10.0 |