Skip to content
Noroxi

Zenoss records

26 published records for vendor zenoss.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
7.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

26 records
  • CVE-2014-6261
    43Plan

    Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary c

    CriticalCVSS 9.3No exploitEPSS 19%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-6262
    32Monitor

    Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote

    HighCVSS 7.5No exploitEPSS 7%

    zenoss · zenoss coreFeb 11, 2020

  • CVE-2019-14258
    31Monitor

    The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated information disclosure via port 9988.

    HighCVSS 7.5No exploitEPSS 1%

    zenoss · zenossAug 21, 2019

  • CVE-2019-14257
    31Monitor

    pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment variables to redirect execution before privileges are dropp

    HighCVSS 7.8No exploitEPSS 0%

    zenoss · zenossAug 21, 2019

  • CVE-2014-9249
    30Monitor

    The default configuration of Zenoss Core before 5 allows remote attackers to read or modify database information by connecting to unspecifie

    HighCVSS 7.5No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-6256
    30Monitor

    Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public (1) r

    HighCVSS 7.5No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-9386
    28Monitor

    Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack ses

    MediumCVSS 6.8No exploitEPSS 2%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2010-0713
    28Monitor

    Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack

    MediumCVSS 6.8Proof of conceptEPSS 1%

    zenoss · zenossFeb 26, 2010

  • CVE-2014-6260
    28Monitor

    Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute ar

    MediumCVSS 6.8No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2010-0712
    27Monitor

    Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote au

    MediumCVSS 6.5Proof of conceptEPSS 1%

    zenoss · zenossFeb 26, 2010

  • CVE-2014-9385
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the authentication of arbi

    MediumCVSS 6.8No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-6253
    27Monitor

    Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to hijack the authenticati

    MediumCVSS 6.8No exploitEPSS 0%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-6255
    26Monitor

    Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web s

    MediumCVSS 6.4No exploitEPSS 2%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2018-25063
    24Monitor

    Zenoss Dashboard defaultportlets.js cross site scripting

    MediumCVSS 6.1No exploitEPSS 0%

    zenoss · dashboardJan 1, 2023

  • CVE-2014-3739
    23Monitor

    Open redirect vulnerability in zport/acl_users/cookieAuthHelper/login_form in Zenoss 4.2.5 allows remote attackers to redirect users to arbi

    MediumCVSS 5.8No exploitEPSS 1%

    zenoss · zenossMay 20, 2014

  • CVE-2014-6259
    20Monitor

    Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of

    MediumCVSS 5.0No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-9250
    20Monitor

    Zenoss Core through 5 Beta 3 does not include the HTTPOnly flag in a Set-Cookie header for the authentication cookie, which makes it easier

    MediumCVSS 5.0No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-6258
    20Monitor

    An unspecified endpoint in Zenoss Core through 5 Beta 3 allows remote attackers to cause a denial of service (CPU consumption) by triggering

    MediumCVSS 5.0No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-6257
    20Monitor

    Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions by using a web-endpoint URL to invoke an object

    MediumCVSS 5.0No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-9245
    20Monitor

    Zenoss Core through 5 Beta 3 allows remote attackers to obtain sensitive information by attempting a product-rename action with an invalid n

    MediumCVSS 5.0No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-9251
    20Monitor

    Zenoss Core through 5 Beta 3 uses a weak algorithm to hash passwords, which makes it easier for context-dependent attackers to obtain cleart

    MediumCVSS 5.0No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-9248
    20Monitor

    Zenoss Core through 5 Beta 3 does not require complex passwords, which makes it easier for remote attackers to obtain access via a brute-for

    MediumCVSS 5.0No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-3738
    18Monitor

    Cross-site scripting (XSS) vulnerability in Zenoss 4.2.5 allows remote attackers to inject arbitrary web script or HTML via the title of a d

    MediumCVSS 4.3Proof of conceptEPSS 3%

    zenoss · zenossMay 20, 2014

  • CVE-2014-6254
    17Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to inject arbitrary web script or

    MediumCVSS 4.3No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014

  • CVE-2014-9247
    16Monitor

    Zenoss Core through 5 Beta 3 allows remote authenticated users to obtain sensitive (1) user account, (2) e-mail address, and (3) role inform

    MediumCVSS 4.0No exploitEPSS 1%

    zenoss · zenoss coreDec 15, 2014