Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
600 results · page 2 of 12
Sep 18, 2023SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/lisCVE-2023-41443 · Other software · Xxyopen · reported by MITREHigh 7.2
SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /sys/menu/list.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2023novel-plus 3.6.2 is vulnerable to SQL Injection.CVE-2023-30058 · Other software · Xxyopen · reported by MITRECritical 9.8
novel-plus 3.6.2 is vulnerable to SQL Injection.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2023novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.CVE-2023-37847 · Other software · Xxyopen · reported by MITRECritical 9.8
novel-plus v3.6.2 was discovered to contain a SQL injection vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnovel.xxyopen.com
Apr 14, 2023A vulnerability classified as critical was found in novel-plus 3.6.2.CVE-2023-2041 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability classified as critical was found in novel-plus 3.6.2. Affected by this vulnerability is an unknown functionality of the file /category/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability classified as critical has been found in novel-plus 3.6.2.CVE-2023-2040 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in novel-plus 3.6.2. Affected is an unknown function of the file /news/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2023A vulnerability was found in novel-plus 3.6.2.CVE-2023-2039 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability was found in novel-plus 3.6.2. It has been rated as critical. This issue affects some unknown processing of the file /author/list?limit=10&offset=0&order=desc. The manipulation of the argument sort leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-225917 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability was found in novel-plus 3.6.2.CVE-2023-1607 · Other software · Xxyopen · reported by VulDBMedium 4.7
A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223737 was assigned to this vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability was found in novel-plus 3.6.2 and classified as critical.CVE-2023-1606 · Other software · Xxyopen · reported by VulDBMedium 6.3
A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223736.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability has been found in novel-plus 3.6.2 and classified as critical.CVE-2023-1595 · Other software · Xxyopen · reported by VulDBMedium 4.7
A vulnerability has been found in novel-plus 3.6.2 and classified as critical. Affected by this vulnerability is an unknown functionality of the file common/log/list. The manipulation of the argument sort leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223663.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023A vulnerability, which was classified as critical, was found in novel-plus 3.6.2.CVE-2023-1594 · Other software · Xxyopen · reported by VulDBHigh 7.3
A vulnerability, which was classified as critical, was found in novel-plus 3.6.2. Affected is the function MenuService of the file sys/menu/list. The manipulation of the argument sort leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223662 is the identifier assigned to this vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file.CVE-2022-36672 · Other software · Xxyopen · reported by MITRECritical 9.8
Novel-Plus v3.6.2 was discovered to contain a hard-coded JWT key located in the project config file. This vulnerability allows attackers to create a custom user session.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2022Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API.CVE-2022-36671 · Other software · Xxyopen · reported by MITREHigh 7.5
Novel-Plus v3.6.2 was discovered to contain an arbitrary file download vulnerability via the background file download API.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.CVE-2022-35121 · Other software · Xxyopen · reported by MITRECritical 9.8
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2022NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack.CVE-2022-30699 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 6.5
NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached delegation information is about to expire. The rogue nameserver delays the response so that the cached delegation information is expired. Upon receiving the delayed answer containing the delegation information, Unbound overwrites the now expired entries. This action can be repeated when the delegation information is about to expire making the rogue delegation information ever-updating. From version 1.16.2 on, Unbound stores the start time for a query and uses that to decide if the cached delegation information can be overwritten.
- Product
- Unbound
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Aug 1, 2022NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack.CVE-2022-30698 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 6.5
NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation. From version 1.16.2 on, Unbound checks the validity of parent delegation records before using cached delegation information.
- Product
- Unbound
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
May 13, 2022Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker toCVE-2021-42967 · Other software · Xxyopen · reported by MITRECritical 9.8
Unrestricted file upload in /novel-admin/src/main/java/com/java2nb/common/controller/FileController.java in novel-plus all versions allows allows an attacker to upload malicious JSP files.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2022novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability.CVE-2022-28462 · Other software · Xxyopen · reported by MITREHigh 7.5
novel-plus 3.6.0 suffers from an Arbitrary file reading vulnerability.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2022novel-plus V3.6.1 allows unrestricted file uploads.CVE-2021-41921 · Other software · Xxyopen · reported by MITRECritical 9.8
novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.CVE-2022-24568 · Other software · Xxyopen · reported by MITRECritical 9.8
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.
- Product
- Novel-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2021Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.CVE-2021-35514 · Other software · Narou Project · reported by MITRECritical 9.8
Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
- Product
- Narou
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvuln.ryotak.me
Apr 29, 2021Directory Traversal in the fileDownload function in com/java2nb/common/controller/FileController.java in Novel-plus (小说精品屋-plus) 3.5.1 allows attackers to read CVE-2021-30048 · Other software · Novel Boutique House-plus Project · reported by MITREMedium 5.3
Directory Traversal in the fileDownload function in com/java2nb/common/controller/FileController.java in Novel-plus (小说精品屋-plus) 3.5.1 allows attackers to read arbitrary files via the filePath parameter.
- Product
- Novel Boutique House-plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jan 25, 2020Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information.CVE-2012-6345 · Other software · Novell · reported by MITREHigh 7.5
Novell ZENworks Configuration Management before 11.2.4 allows obtaining sensitive trace information.
- Product
- Zenworks Configuration Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.comsupport.microfocus.com
Jan 25, 2020Novell ZENworks Configuration Management before 11.2.4 allows XSS.CVE-2012-6344 · Other software · Novell · reported by MITREMedium 6.1
Novell ZENworks Configuration Management before 11.2.4 allows XSS.
- Product
- Zenworks Configuration Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.comsupport.microfocus.com
Nov 21, 2018In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthentCVE-2009-5153 · Other software · Microfocus · reported by MITRECritical 9.8
In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthenticated attackers to execute code, because a length field was incorrectly trusted.
- Product
- Netware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comdownload.novell.com
Mar 2, 2018The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open connections without EBA.CVE-2017-9277 · Other software · Novell · reported by security@opentext.comMedium 4.2
The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open connections without EBA.
- Product
- eDirectory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comnetiq.com
Mar 2, 2018Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using CVE-2017-9276 · Other software · NetIQ · reported by security@opentext.comMedium 5.4
Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2018In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used during SSL BIND operatiCVE-2017-9267 · Other software · Novell · reported by security@opentext.comMedium 6.5
In Novell eDirectory before 9.0.3.1 the LDAP interface was not strictly enforcing cipher restrictions allowing weaker ciphers to be used during SSL BIND operations.
- Product
- eDirectory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2018Novell Access Manager Admin Console and IDP servers before 4.3.3 have a URL that could be used by remote attackers to trigger unvalidated redirects to third parCVE-2017-14802 · Other software · NetIQ · reported by security@opentext.comMedium 5.4
Novell Access Manager Admin Console and IDP servers before 4.3.3 have a URL that could be used by remote attackers to trigger unvalidated redirects to third party sites.
- Product
- Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2017The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root.CVE-2016-5759 · Other software · Novell · reported by security@opentext.comHigh 7.8
The mkdumprd script called "dracut" in the current working directory "." allows local users to trick the administrator into executing code as root.
- Product
- Suse Linux Enterprise Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.suse.com
Aug 9, 2017Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attackersCVE-2015-0786 · Other software · Novell · reported by security@opentext.comCritical 9.8
Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary code via unspecified vectors.
- Product
- Zenworks Configuration Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 9, 2017com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders viCVE-2015-0785 · Other software · Novell · reported by security@opentext.comHigh 7.5
com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders via the dirname variable.
- Product
- Zenworks Configuration Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comzerodayinitiative.com
Aug 9, 2017Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for thCVE-2015-0784 · Other software · Novell · reported by security@opentext.comHigh 7.5
Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable.
- Product
- Zenworks Configuration Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Aug 9, 2017The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the filename variable.CVE-2015-0783 · Other software · Novell · reported by security@opentext.comMedium 6.5
The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the filename variable.
- Product
- Zenworks Configuration Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comzerodayinitiative.com
Aug 9, 2017SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execuCVE-2015-0782 · Other software · Novell · reported by security@opentext.comCritical 9.8
SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Zenworks Configuration Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comzerodayinitiative.com
Aug 9, 2017Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload aCVE-2015-0781 · Other software · Novell · reported by security@opentext.comCritical 9.8
Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload and execute arbitrary files via unspecified vectors.
- Product
- Zenworks Configuration Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comzerodayinitiative.com
Aug 9, 2017SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackerCVE-2015-0780 · Other software · Novell · reported by security@opentext.comCritical 9.8
SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Zenworks Configuration Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
May 3, 2017Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability.CVE-2017-7432 · Other software · Novell · reported by security@opentext.comCritical 9.8
Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability.
- Product
- Imanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.novell.comdl.netiq.com
May 3, 2017Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management.CVE-2017-7431 · Other software · Novell · reported by security@opentext.comHigh 8.8
Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management.
- Product
- Imanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.novell.combugzilla.novell.com
May 3, 2017Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework.CVE-2017-7430 · Other software · Novell · reported by security@opentext.comMedium 6.1
Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework.
- Product
- Imanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.novell.combugzilla.novell.com
Apr 27, 2017Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x befCVE-2017-5186 · Other software · Netiq · reported by security@opentext.comHigh 7.5
Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x before 9.0.2 Hotfix 2 (9.0.2.2) use the deprecated MD5 hashing algorithm in a communications certificate.
- Product
- Edirectory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.novell.combugzilla.novell.com
Apr 20, 2017Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code vCVE-2016-5762 · Other software · Novell · reported by security@opentext.comCritical 9.8
Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code via a long (1) username or (2) password, which triggers a heap-based buffer overflow.
- Product
- Groupwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 20, 2017Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allows remote attackers to inject arbitrary web script orCVE-2016-5761 · Other software · Novell · reported by security@opentext.comMedium 6.1
Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allows remote attackers to inject arbitrary web script or HTML via a crafted email.
- Product
- Groupwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 20, 2017Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attaCVE-2016-5760 · Other software · Novell · reported by security@opentext.comMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attackers to inject arbitrary web script or HTML via the (1) token parameter to gwadmin-console/install/login.jsp or (2) PATH_INFO to gwadmin-console/index.jsp.
- Product
- Groupwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Mar 23, 2017A reflected XSS vulnerability exists in the web console of the Document Viewer Agent in Novell GroupWise before 2014 R2 Support Pack 1 Hot Patch 2 that may enabCVE-2016-9169 · Other software · Novell · reported by security@opentext.comMedium 6.1
A reflected XSS vulnerability exists in the web console of the Document Viewer Agent in Novell GroupWise before 2014 R2 Support Pack 1 Hot Patch 2 that may enable a remote attacker to execute JavaScript in the context of a valid user's browser session by getting the user to click on a specially crafted link. This could lead to session compromise or other browser-based attacks.
- Product
- Groupwise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comnovell.com
Mar 23, 2017A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking.CVE-2016-9168 · Other software · Novell · reported by security@opentext.comMedium 6.5
A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking.
- Product
- Edirectory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comnovell.com
Mar 23, 2017NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation CVE-2016-9167 · Other software · Novell · reported by security@opentext.comHigh 7.5
NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user attributes that would otherwise be filtered by an ACL.
- Product
- Edirectory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comnovell.com
Mar 23, 2017A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intendeCVE-2016-5747 · Other software · Novell · reported by security@opentext.comHigh 7.5
A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intended access restrictions by leveraging predictable cookies.
- Product
- Edirectory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2017An information leak in the NetIQ IDM ServiceNow Driver before 1.0.0.1 could expose cryptographic attributes to logged-in users.CVE-2016-1603 · Other software · Novell · reported by security@opentext.comMedium 6.5
An information leak in the NetIQ IDM ServiceNow Driver before 1.0.0.1 could expose cryptographic attributes to logged-in users.
- Product
- Netiq IDM Servicenow Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.novell.comdownload.novell.com
Mar 11, 2017Remote attackers can use the iPrint web-browser ActiveX plugin in Novell iPrint Client before 5.42 for Windows XP/Vista/Win7 to execute code by overflowing the CVE-2010-4314 · Other software · Novell · reported by security@opentext.comHigh 8.8
Remote attackers can use the iPrint web-browser ActiveX plugin in Novell iPrint Client before 5.42 for Windows XP/Vista/Win7 to execute code by overflowing the "name" parameter.
- Product
- Iprint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2016Vulnerability in Novell Open Enterprise Server (OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 CVE-2016-5763 · Other software · Novell · reported by security@opentext.comCritical 9.1
Vulnerability in Novell Open Enterprise Server (OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989) might allow authenticated remote attackers to perform unauthorized file access and modification.
- Product
- Open Enterprise Server 11
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.novell.comdownload.novell.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.