Zenoss Zenoss Core
19 CVEs affecting Zenoss Zenoss Core. Latest disclosed: 2020-02-12. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-6262 | High | 7.5 | 2020-02-12 | Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execu… |
CVE-2014-9386 | | 2014-12-15 | Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging… | |
CVE-2014-9385 | | 2014-12-15 | Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the authentication of arbitrary users for req… | |
CVE-2014-9252 | | 2014-12-15 | Zenoss Core through 5 Beta 3 stores cleartext passwords in the session database, which might allow local users to obtain sensitive information by reading datab… | |
CVE-2014-9251 | | 2014-12-15 | Zenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleartext values via a br… | |
CVE-2014-9250 | | 2014-12-15 | Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier for remote attacker… | |
CVE-2014-9249 | | 2014-12-15 | The default configuration of Zenoss Core before 5 allows remote attackers to read or modify database information by connecting to unspecified open ports, aka Z… | |
CVE-2014-9248 | | 2014-12-15 | Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-force attack, aka ZEN-… | |
CVE-2014-9247 | | 2014-12-15 | Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-mail address, and (3) role information by visiting t… | |
CVE-2014-9245 | | 2014-12-15 | Zenoss Core through 5 Beta 3 allows remote attackers to obtain sensitive information by attempting a product-rename action with an invalid new name and then re… | |
CVE-2014-6261 | | 2014-12-15 | Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary code by (1) spoofing… | |
CVE-2014-6260 | | 2014-12-15 | Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or… | |
CVE-2014-6259 | | 2014-12-15 | Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and… | |
CVE-2014-6258 | | 2014-12-15 | An unspecified endpoint in Zenoss Core through 5 Beta 3 allows remote attackers to cause a denial of service (CPU consumption) by triggering an arbitrary regul… | |
CVE-2014-6257 | | 2014-12-15 | Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions by using a web-endpoint URL to invoke an object helper method, aka… | |
CVE-2014-6256 | | 2014-12-15 | Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public (1) read or (2) execute… | |
CVE-2014-6255 | | 2014-12-15 | Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web sites and conduct ph… | |
CVE-2014-6254 | | 2014-12-15 | Multiple cross-site scripting (XSS) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to inject arbitrary web script or HTML via an attrib… | |
CVE-2014-6253 | | 2014-12-15 | Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to hijack the authentication of arbitrary use… |