CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5747
https://notcve.org/view.php?id=CVE-2016-5747
A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intended access restrictions by leveraging predictable cookies. Una vulnerabilidad de seguridad en el manejo de cookies en la implementación http en pila en NDSD en Novell eDirectory en versiones anteriores a 9.0.1 permite a atacantes remotos eludir las restricciones destinadas al acceso aprovechando cookies predecibles. • https://www.novell.com/support/kb/doc.php?id=7016794 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9167
https://notcve.org/view.php?id=CVE-2016-9167
NDSD in Novell eDirectory before 9.0.2 did not calculate ACLs on LDAP objects across partition boundaries correctly, which could lead to a privilege escalation by modifying user attributes that would otherwise be filtered by an ACL. NDSD en Novell eDirectory en versiones anteriores a 9.0.2 no calculó correctamente ACLs en objetos LDAP a través de límites de partición, lo que podría provocar una escalada de privilegios por la modificación de los atributos de usuario lo que podría conducir a una escalada de privilegios modificando atributos de usuario que de otro modo serían filtrados por una ACL. • http://www.securityfocus.com/bid/97315 https://www.novell.com/support/kb/doc.php?id=7016794 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-9168
https://notcve.org/view.php?id=CVE-2016-9168
A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking. Una cabecera X-Frame-Options perdida en el NDS Utility Monitor en NDSD en Novell eDirectory en versiones anteriores a 9.0.2 podría ser utilizada por atacantes remotos para clickjacking. • http://www.securityfocus.com/bid/97320 https://www.novell.com/support/kb/doc.php?id=7016794 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 59%CPEs: 22EXPL: 0CVE-2009-0895
https://notcve.org/view.php?id=CVE-2009-0895
Integer overflow in Novell eDirectory 8.7.3.x before 8.7.3.10 ftf2 and 8.8.x before 8.8.5.2 allows remote attackers to execute arbitrary code via an NDS Verb 0x1 request containing a large integer value that triggers a heap-based buffer overflow. Desbordamiento de entero en Novell eDirectory v8.7.3.x anteriores a v8.7.3.10 ftf2 y v8.8.x anteriores a v8.8.5.2 permite a atacantes remotos ejecutar código arbitrario a través de la peticion NDS 0x1 conteniendo un valor de entero largo que inicia un desbordamiento de búfer basado en pila. • http://secunia.com/advisories/37554 http://www.iss.net/threats/356.html http://www.novell.com/support/viewContent.do?externalId=7004912 http://www.securityfocus.com/bid/37184 http://www.vupen.com/english/advisories/2009/3379 https://bugzilla.novell.com/show_bug.cgi?id=524344 https://bugzilla.novell.com/show_bug.cgi?id=545887 https://exchange.xforce.ibmcloud.com/vulnerabilities/50616 • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 2%CPEs: 18EXPL: 0CVE-2009-3862 – Novell eDirectory LDAP Null Base DN Denial of Service Vulnerability
https://notcve.org/view.php?id=CVE-2009-3862
The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and eDirectory 8.8 before 8.8.5 ftf1 does not properly handle certain LDAP search requests, which allows remote attackers to cause a denial of service (application hang) via a search request with a NULL BaseDN value. El proceso NDSD en Novell eDirectory v8.7.3 anterior a v8.7.3.10 ftf2 y eDirectory v8.8 anterior a v8.8.5 ftf1 no maneja adecuadamente ciertas peticiones de búsqueda de LDAP, lo que permite a atacantes remoto provocar una denegación de servicio (cuelgue de aplicación) a través de una petición de búsqueda con valor BaseDN NULL. This vulnerability allows attackers to deny services on vulnerable installations of Novell eDirectory. Authentication is not required in order to exploit this vulnerability. The specific flaw exists within Novell's eDirectory Server's LDAP implementation. Novell eDirectory's NDSD process binds to port 389/TCP for handling LDAP requests. • http://www.novell.com/support/viewContent.do?externalId=7004721 http://www.securityfocus.com/bid/36902 http://www.vupen.com/english/advisories/2009/3120 http://www.zerodayinitiative.com/advisories/ZDI-09-075 • CWE-287: Improper Authentication •