CVSS: 6.8EPSS: 0%CPEs: 17EXPL: 0CVE-2013-1088
https://notcve.org/view.php?id=CVE-2013-1088
Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container. Una vulnerabilidad de tipo cross-site request forgery (CSRF) en iManager de Novell versión 2.7 anterior a SP6 Parche 1, permite a los atacantes remotos secuestrar la autenticación de usuarios arbitrarios mediante el aprovechamiento de la comprobación incorrecta de peticiones para código desplegado de iManager dentro de un contenedor Apache Tomcat. • http://www.novell.com/support/kb/doc.php?id=7010166 https://bugzilla.novell.com/show_bug.cgi?id=726260 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.0EPSS: 82%CPEs: 10EXPL: 0CVE-2011-4188
https://notcve.org/view.php?id=CVE-2011-4188
Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted EnteredAttrName parameter, a related issue to CVE-2010-1929. Desbordamiento de búfer en la función "Create Attribute" de JClient en Novell iManager v2.7.4 antes del parche 4 permite a usuarios remotos autenticados provocar una denegación de servicio (caída de la aplicación) o posiblemente tener otro impacto no especificado a través de un parámetro EnteredAttrName modificado a mano. Se trata de un problema relacionado con CVE-2010-1929. • http://secunia.com/advisories/48672 http://www.novell.com/support/viewContent.do?externalId=7002971 http://www.securitytracker.com/id?1026894 https://exchange.xforce.ibmcloud.com/vulnerabilities/74669 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 61%CPEs: 3EXPL: 5CVE-2010-1929 – Novell iManager - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-1929
Multiple stack-based buffer overflows in the jclient._Java_novell_jclient_JClient_defineClass@20 function in jclient.dll in the Tomcat web server in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allow remote authenticated users to execute arbitrary code via the (1) EnteredClassID or (2) NewClassName parameter to nps/servlet/webacc. Múltiple desbordamiento de búfer basado en pila en la función jclient._Java_novell_jclient_JClient_defineClass@20 en jclient.dll en servidor Web Tomcat en Novell iManager v2.7, v2.7.3, y v2.7.3 FTF2 permite a usuarios autenticados remotos ejecutar código de su elección a través de lso parámetros (1) EnteredClassID o (2) NewClassName sobre nps/servlet/webacc. • https://www.exploit-db.com/exploits/14010 http://secunia.com/advisories/40281 http://securitytracker.com/id?1024152 http://www.coresecurity.com/content/novell-imanager-buffer-overflow-off-by-one-vulnerabilities http://www.exploit-db.com/exploits/14010 http://www.osvdb.org/65737 http://www.securityfocus.com/archive/1/511983/100/0/threaded http://www.securityfocus.com/bid/40480 http://www.vupen.com/english/advisories/2010/1575 https://exchange.xforce.ibmcloud.com/vulnerabilities/59694 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 3%CPEs: 3EXPL: 4CVE-2010-1930 – Novell iManager - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-1930
Off-by-one error in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allows remote attackers to cause a denial of service (daemon crash) via a long tree parameter in a login request to nps/servlet/webacc. Error de superación de límite (off-by-one) en Novell iManager V2.7, V2.7.3, y 2.7.3 FTF2, permite a atacantes remotos provocar una denegación de servicio (caída del demonio) a través de un parámetro tree largo en una petición de loging sobre nps/servlet/webacc. • https://www.exploit-db.com/exploits/14010 http://secunia.com/advisories/40281 http://securitytracker.com/id?1024152 http://www.coresecurity.com/content/novell-imanager-buffer-overflow-off-by-one-vulnerabilities http://www.exploit-db.com/exploits/14010 http://www.osvdb.org/65738 http://www.securityfocus.com/archive/1/511983/100/0/threaded http://www.securityfocus.com/bid/40485 http://www.vupen.com/english/advisories/2010/1575 https://exchange.xforce.ibmcloud.com/vulnerabilities/59695 • CWE-189: Numeric Errors •
CVSS: 10.0EPSS: 61%CPEs: 7EXPL: 0CVE-2009-4486 – Novell iManager eDirectory Plugin Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2009-4486
Stack-based buffer overflow in the eDirectory plugin in Novell iManager before 2.7.3 allows remote attackers to execute arbitrary code via vectors that trigger long arguments to an unspecified sub-application, related to importing and exporting from a schema. Desbordamiento del búfer de la pila en el plugin eDirectory en Novell iManager anterior a v2.7.3 permite a atacantes remotos ejecutar código de su elección a través de vectores que provoca argumentos largos para una sub-aplicación sin especificar, relacionado con la importación y exportación de un esquema. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Novell iManager. Authentication is not required to exploit this vulnerability. The flaw exists in an application called by the iManager in order to handle importing/exporting of schema information. While importing/exporting from the schema, the sub-application fails to validate the length of its arguments while copying user-supplied data into statically allocated stack buffer. • http://osvdb.org/61584 http://secunia.com/advisories/38030 http://www.novell.com/support/viewContent.do?externalId=7004985&sliceId=1 http://www.securityfocus.com/bid/37672 http://www.vupen.com/english/advisories/2010/0074 http://www.zerodayinitiative.com/advisories/ZDI-10-001 https://exchange.xforce.ibmcloud.com/vulnerabilities/55468 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •