NVD List
| Id | Name | Description | Reject | CVSS Version | CVSS Score | Severity | Pub Date | Modified Date | Actions |
|---|---|---|---|---|---|---|---|---|---|
| 33806 | CVE-2014-6260 | Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or cause a denial of service (paging outage) by leveraging an unattended workstation, aka ZEN-15412. | 2 | 6.8 | Medium | 2017-01-19 | 2016-03-21 | View | |
| 33807 | CVE-2014-6261 | Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary code by (1) spoofing the callhome server or (2) deploying a crafted web site that is visited during a login session, aka ZEN-12657. | 2 | 9.3 | High | 2017-01-19 | 2016-03-21 | View | |
| 33805 | CVE-2014-6259 | Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka ZEN-15414, a similar issue to CVE-2003-1564. | 2 | 5 | Medium | 2017-01-19 | 2016-03-21 | View | |
| 35992 | CVE-2014-9250 | Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier for remote attackers to obtain credential information via script access to this cookie, aka ZEN-10418. | 2 | 5 | Medium | 2017-01-19 | 2016-03-21 | View | |
| 35989 | CVE-2014-9247 | Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-mail address, and (3) role information by visiting the ZenUsers (aka User Manager) page, aka ZEN-15389. | 2 | 4 | Medium | 2017-01-19 | 2016-03-21 | View |
Page 29 of 17672, showing 5 records out of 88360 total, starting on record 141, ending on 145
