CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 76551 | CVE-2014-9250 | Candidate | Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier for remote attackers to obtain credential information via script access to this cookie, aka ZEN-10418. | Assigned (20141203) | None (candidate not yet proposed) | View | |
| 73558 | CVE-2014-6259 | Candidate | Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka ZEN-15414, a similar issue to CVE-2003-1564. | Assigned (20140905) | None (candidate not yet proposed) | View | |
| 73560 | CVE-2014-6261 | Candidate | Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary code by (1) spoofing the callhome server or (2) deploying a crafted web site that is visited during a login session, aka ZEN-12657. | Assigned (20140905) | None (candidate not yet proposed) | View | |
| 73559 | CVE-2014-6260 | Candidate | Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or cause a denial of service (paging outage) by leveraging an unattended workstation, aka ZEN-15412. | Assigned (20140905) | None (candidate not yet proposed) | View | |
| 76549 | CVE-2014-9248 | Candidate | Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-force attack, aka ZEN-15406. | Assigned (20141203) | None (candidate not yet proposed) | View |
Page 20916 of 20943, showing 5 records out of 104715 total, starting on record 104576, ending on 104580
