CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9168
https://notcve.org/view.php?id=CVE-2016-9168
A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking. Una cabecera X-Frame-Options perdida en el NDS Utility Monitor en NDSD en Novell eDirectory en versiones anteriores a 9.0.2 podría ser utilizada por atacantes remotos para clickjacking. • http://www.securityfocus.com/bid/97320 https://www.novell.com/support/kb/doc.php?id=7016794 • CWE-20: Improper Input Validation •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 1CVE-2014-5213 – NetIQ eDirectory NDS iMonitor 8.8 SP8 / 8.8 SP7 XSS / Memory Disclosure
https://notcve.org/view.php?id=CVE-2014-5213
nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authenticated users to obtain sensitive information from process memory via a direct request. nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images en iMonitor de Novell eDirectory anterior a 8.8 SP8 Patch 4 permite a usuarios remotos autenticados obtener información sensible de la memoria del proceso a través de una petición directa. NetIQ eDirectory NDS iMonitor versions 8.8 SP8 and 8.8 SP7 suffer from a cross site scripting vulnerability. • http://www.securityfocus.com/archive/1/534284 http://www.securitytracker.com/id/1031408 https://bugzilla.novell.com/show_bug.cgi?id=904135 https://www.novell.com/support/kb/doc.php?id=3426981 https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141219-0_NetIQ_eDirectory_iMonitor_XSS_Memory_Disclosure_v10.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 19%CPEs: 1EXPL: 0CVE-2014-5212 – NetIQ eDirectory NDS iMonitor 8.8 SP8 / 8.8 SP7 XSS / Memory Disclosure
https://notcve.org/view.php?id=CVE-2014-5212
Cross-site scripting (XSS) vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers to inject arbitrary web script or HTML via the rdn parameter. Vulnerabilidad de XSS en nds/search/data en iMonitor de Novell eDirectory anterior a 8.8 SP8 Patch 4 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro rdn. NetIQ eDirectory NDS iMonitor versions 8.8 SP8 and 8.8 SP7 suffer from a cross site scripting vulnerability. • http://www.securityfocus.com/archive/1/534284 http://www.securitytracker.com/id/1031408 https://bugzilla.novell.com/show_bug.cgi?id=904134 https://www.novell.com/support/kb/doc.php?id=3426981 https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141219-0_NetIQ_eDirectory_iMonitor_XSS_Memory_Disclosure_v10.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 12%CPEs: 2EXPL: 0CVE-2010-4327 – Novell eDirectory Malformed NCP Request Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2010-4327
Unspecified vulnerability in the NCP service in Novell eDirectory 8.8.5 before 8.8.5.6 and 8.8.6 before 8.8.6.2 allows remote attackers to cause a denial of service (hang) via a malformed FileSetLock request to port 524. Vulnerabilidad no especificada en el servicio NPC en Novell eDirectory v8.8.5 anterior a v8.8.5.6 y v8.8.6 anterior a v8.8.6.2, permite a atacantes remotos provocar una denegación de servicio (cuelgue) a través de una petición FileSetLock mal formada al puerto 524. This vulnerability allows attackers to deny services on vulnerable installations of Novell eDirectory. Authentication is not required in order to trigger this vulnerability. The flaw exists within Novell's eDirectory Server's NCP implementation. Novell's eDirectory Server binds to port 524 for processing NCP requests. • http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-novell http://secunia.com/advisories/43186 http://securityreason.com/securityalert/8071 http://www.novell.com/support/viewContent.do?externalId=7007781&sliceId=2 http://www.securityfocus.com/archive/1/516279/100/0/threaded http://www.securityfocus.com/bid/46263 http://www.vupen.com/english/advisories/2011/0305 http://www.zerodayinitiative.com/advisories/ZDI-11-060 •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 2CVE-2009-4653 – Novell eDirectory 8.8 - '/dhost/modules?I:' Remote Buffer Overflow
https://notcve.org/view.php?id=CVE-2009-4653
Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to cause a denial of service (dhost.exe crash) and possibly execute arbitrary code via a long string to /dhost/modules?I:. Desbordamiento de búfer basado en pila en el módulo dhost en Novell eDirectory v8.8 SP5 para Windows, permite a usuarios autenticados remotos a provocar una denegación de servicio (caida de dhost.exe) y posiblemente ejecutar código arbitrario a través de una cadena larga sobre /dhost/modules?I:. • https://www.exploit-db.com/exploits/33351 http://www.securityfocus.com/archive/1/507812/100/0/threaded http://www.securityfocus.com/bid/37009 https://exchange.xforce.ibmcloud.com/vulnerabilities/54264 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •