CVSS: 7.8EPSS: 1%CPEs: 3EXPL: 0CVE-2017-5182
https://notcve.org/view.php?id=CVE-2017-5182
Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total information disclosure. This vulnerability is present on all versions of OES for linux, it applies to OES2015 SP1 before Maintenance Update 11080, OES2015 before Maintenance Update 11079, OES11 SP3 before Maintenance Update 11078, OES11 SP2 before Maintenance Update 11077). Remote Manager en Open Enterprise Server (OES) permite a atacantes remotos no autenticados leer cualquier archivo arbitrario, a través de una URL especialmente manipulada, que permite un salto de directorio completo y una divulgación total de información. Esta vulnerabilidad esta presente en todas las versiones de OES para linux, it applies to OES2015 SP1 en versiones anteriores a Maintenance Update 11080, OES2015 en versiones anteriores a Maintenance Update 11079, OES11 SP3 en versiones anteriores a Maintenance Update 11078, OES11 SP2 en versiones anteriores a Maintenance Update 11077). • http://www.securityfocus.com/bid/95743 http://www.securitytracker.com/id/1037689 https://www.novell.com/support/kb/doc.php?id=7018503 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2016-5763
https://notcve.org/view.php?id=CVE-2016-5763
Vulnerability in Novell Open Enterprise Server (OES2015 SP1 before Scheduled Maintenance Update 10992, OES2015 before Scheduled Maintenance Update 10990, OES11 SP3 before Scheduled Maintenance Update 10991, OES11 SP2 before Scheduled Maintenance Update 10989) might allow authenticated remote attackers to perform unauthorized file access and modification. Vulnerabilidad en Novell Open Enterprise Server (OES2015 SP1 en versiones anteriores a Scheduled Maintenance Update 10992, OES2015 en versiones anteriores a Scheduled Maintenance Update 10990, OES11 SP3 en versiones anteriores a Scheduled Maintenance Update 10991, OES11 SP2 en versiones anteriores a Scheduled Maintenance Update 10989) podría permitir a atacantes remotos autenticados llevar a cabo un acceso y modificación no autorizado de archivos. • http://download.novell.com/Download?buildid=3Ho1yp5JOXA~ http://download.novell.com/Download?buildid=Fj0Hdns7mxA~ http://download.novell.com/Download?buildid=dfqmrymc0Rg~ http://download.novell.com/Download?buildid=s9_RxhgC8KU~ http://www.securityfocus.com/bid/94348 • CWE-254: 7PK - Security Features •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2016-1598
https://notcve.org/view.php?id=CVE-2016-1598
XSS in NetIQ IDM 4.5 Identity Applications before 4.5.4 allows attackers able to change their username to inject arbitrary HTML code into the Role Assignment administrator HTML pages. XSS en NetIQ IDM 4.5 Identity Applications en versiones anteriores a 4.5.4 permite a los atacantes capaces de cambiar su nombre de usuario inyectar un código HTML arbitrario dentro de las páginas HTML de administrador Role Assignment. • http://www.securityfocus.com/bid/93833 https://download.novell.com/Download?buildid=xyswDCMsT7I~ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 13EXPL: 2CVE-2016-7796 – systemd: freeze when PID 1 receives a zero-length message over notify socket
https://notcve.org/view.php?id=CVE-2016-7796
The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a notify socket, which causes an error to be returned and the notification handler to be disabled. La función manager_dispatch_notify_fd en systemd permite a usuarios locales provocar una denegación de servicio (colgado de sistema) a través de un mensaje de longitud cero recibido sobre una notificación de encaje, lo que provoca que se devuelva un error y que el controlador de notificación se desactive. A flaw was found in the way systemd handled empty notification messages. A local attacker could use this flaw to make systemd freeze its execution, preventing further management of system services, system shutdown, or zombie process collection via systemd. • http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00015.html http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00016.html http://rhn.redhat.com/errata/RHSA-2017-0003.html http://www.openwall.com/lists/oss-security/2016/09/30/1 http://www.securityfocus.com/bid/93250 http://www.securitytracker.com/id/1037320 https://bugzilla.redhat.com/show_bug.cgi?id=1381911 https://github.com/systemd/systemd/issues/4234#issuecomment-250441246 https://rhn.redhat.com/e • CWE-20: Improper Input Validation CWE-253: Incorrect Check of Function Return Value •
CVSS: 7.5EPSS: 42%CPEs: 5EXPL: 0CVE-2016-7052
https://notcve.org/view.php?id=CVE-2016-7052
crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation. crypto/x509/x509_vfy.c en OpenSSL 1.0.2i permite a atacantes remotos provocar una denegación de servicio (referencia a puntero NULL y caída de aplicación) desencadenando una operación CRL. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html http://www-01.ibm.com/support/docview.wss?uid=swg21995039 http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www&# • CWE-476: NULL Pointer Dereference •