Zenoss Core
Vendor:
First CVE: Dec 15, 2014 · Active for 11 years
19
Total CVEs
More Total CVEs than 95% of tracked products
9.5
Avg CVEs / Year
Higher CVE frequency than 96% of tracked products
5.8
Avg CVSS
Higher Avg CVSS than 21% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Zenoss Core over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 15, 2014
11 years ago
Most Recent CVE
Feb 12, 2020
2,357 days ago
CVE Severity & Scoring
Zenoss Core19 CVEs
74%
21%
All CVEs352,785 CVEs
45%
40%
11%
LowMediumHigh
Attack Vector
Local0 (0.0%)
Network1 (5.3%)
Unknown18 (94.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low1 (5.3%)
High0 (0.0%)
Unknown18 (94.7%)
User Interaction
None1 (5.3%)
Unknown18 (94.7%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None1 (5.3%)
Unknown18 (94.7%)
Top CVEs
Signals from CVEs in this product scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-6261HIGH Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature, which allows remote attackers to execute arbitrary code by (1) spoofing the callhome server | Dec 15, 2014 | 9.3 | 38 | NO | NO |
CVE-2014-6262HIGH Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or | Feb 12, 2020 | 7.5 | 27 | NO | NO |
CVE-2014-6256HIGH Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access restrictions and place files in a directory with public (1) read or (2) execute access via a move act | Dec 15, 2014 | 7.5 | 23 | NO | NO |
CVE-2014-6260MEDIUM Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or cause a denial of se | Dec 15, 2014 | 6.8 | 22 | NO | NO |
CVE-2014-6255MEDIUM Open redirect vulnerability in the login form in Zenoss Core before 4.2.5 SP161 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via th | Dec 15, 2014 | 6.4 | 22 | NO | NO |
CVE-2014-6253MEDIUM Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss Core through 5 Beta 3 allow remote attackers to hijack the authentication of arbitrary users, aka ZEN-12653. | Dec 15, 2014 | 6.8 | 22 | NO | NO |
CVE-2014-9249HIGH The default configuration of Zenoss Core before 5 allows remote attackers to read or modify database information by connecting to unspecified open ports, aka ZEN-15408. | Dec 15, 2014 | 7.5 | 19 | NO | NO |
CVE-2014-9386MEDIUM Zenoss Core before 4.2.5 SP161 sets an infinite lifetime for the session ID cookie, which makes it easier for remote attackers to hijack sessions by leveraging an unattended workst | Dec 15, 2014 | 6.8 | 18 | NO | NO |
CVE-2014-9385MEDIUM Cross-site request forgery (CSRF) vulnerability in Zenoss Core through 5 Beta 3 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger ar | Dec 15, 2014 | 6.8 | 18 | NO | NO |
CVE-2014-6259MEDIUM Zenoss Core through 5 Beta 3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via | Dec 15, 2014 | 5.0 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (19 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (19 CVEs).
Media Mentions
Signals from CVEs in this product scope (19 CVEs).
Top CNAs Publishing CVEs For Zenoss Core
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 5.0.0 | 15 | 5.5 | 2.5% | 0 | 0 |
| 4.2.5 | 15 | 5.5 | 2.5% | 0 | 0 |
| 4.2.4 | 18 | 5.7 | 2.4% | 0 | 0 |
| 4.2.3 | 18 | 5.7 | 2.4% | 0 | 0 |
| 4.2.0 | 18 | 5.7 | 2.4% | 0 | 0 |
| 3.2.1 | 18 | 5.7 | 2.4% | 0 | 0 |
| 3.2.0 | 18 | 5.7 | 2.4% | 0 | 0 |
| 3.1.0 | 18 | 5.7 | 2.4% | 0 | 0 |
| 3.0.3 | 18 | 5.7 | 2.4% | 0 | 0 |
| 3.0.2 | 18 | 5.7 | 2.4% | 0 | 0 |
| 3.0.1 | 18 | 5.7 | 2.4% | 0 | 0 |
| 3.0.0 | 18 | 5.7 | 2.4% | 0 | 0 |
| 2.5.2 | 18 | 5.7 | 2.4% | 0 | 0 |
| 2.5.1 | 18 | 5.7 | 2.4% | 0 | 0 |
| 2.5.0 | 18 | 5.7 | 2.4% | 0 | 0 |
| 2.4.5 | 18 | 5.7 | 2.4% | 0 | 0 |
| 2.4.0 | 18 | 5.7 | 2.4% | 0 | 0 |