Novell vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2012-6345 Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information.High 7.5 · Jan 25, 2020
• CVE-2016-5759 The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root.High 7.8 · Sep 8, 2017
• CVE-2015-0786 Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attackersCritical 9.8 · Aug 9, 2017
• CVE-2015-0785 com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders viHigh 7.5 · Aug 9, 2017
• CVE-2015-0784 Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for thHigh 7.5 · Aug 9, 2017
• CVE-2015-0782 SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execuCritical 9.8 · Aug 9, 2017
• CVE-2015-0781 Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload aCritical 9.8 · Aug 9, 2017
• CVE-2015-0780 SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackerCritical 9.8 · Aug 9, 2017
• CVE-2017-7432 Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability.Critical 9.8 · May 3, 2017
• CVE-2017-7431 Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management.High 8.8 · May 3, 2017
• CVE-2016-5762 Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code vCritical 9.8 · Apr 20, 2017
• CVE-2016-9167 NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation High 7.5 · Mar 23, 2017
• CVE-2016-5747 A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intendeHigh 7.5 · Mar 23, 2017
• CVE-2010-4314 Remote attackers can use the iPrint web-browser ActiveX plugin in Novell iPrint Client before 5.42 for Windows XP/Vista/Win7 to execute code by overflowing the High 8.8 · Mar 11, 2017
• CVE-2016-5763 Vulnerability in Novell Open Enterprise Server (OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 Critical 9.1 · Nov 15, 2016
• CVE-2016-7052 crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CHigh 7.5 · Sep 26, 2016
• CVE-2015-8921 The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafteHigh 7.5 · Sep 20, 2016
• CVE-2015-8918 The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cabHigh 7.5 · Sep 20, 2016
• CVE-2016-1611 Novell Filr 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 uses world-writable permissions for /etc/profile.d/vainit.sh, which allows local users to gain priHigh 7.8 · Jul 31, 2016
• CVE-2016-1610 Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attacHigh 7.5 · Jul 31, 2016
• CVE-2016-1608 vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via sHigh 8.8 · Jul 31, 2016
• CVE-2016-1607 Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers toHigh 7.2 · Jul 31, 2016
• CVE-2016-0376 The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SRHigh 8.1 · Jun 3, 2016
• CVE-2016-4805 Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corruptioHigh 7.8 · May 23, 2016
• CVE-2016-4485 The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain seHigh 7.5 · May 23, 2016