CVSS: 10.0EPSS: 52%CPEs: 2EXPL: 3CVE-2012-5932 – NetIQ Privileged User Manager 2.3.1 - 'ldapagnt_eval()' Perl Remote Code Execution
https://notcve.org/view.php?id=CVE-2012-5932
Eval injection vulnerability in the ldapagnt_eval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request. Una vulnerabilidad de inyección de Eval en la función ldapagnt_eval en ldapagnt.dll en unifid.exe en NetIQ Privileged User Manager v2.3.x antes de v2.3.1 HF2 permite a atacantes remotos ejecutar código Perl de su elección a través una solicitud application/x-amf hecha a mano. • https://www.exploit-db.com/exploits/22903 http://download.novell.com/Download?buildid=K6-PmbPjduA~ http://retrogod.altervista.org/9sg_novell_netiq_ii.htm http://retrogod.altervista.org/9sg_novell_netiq_ldapagnt_adv.htm https://www.netiq.com/support/kb/doc.php?id=7011385 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2012-5931 – Novell NetIQ Privileged User Manager 2.3.1 - 'auth.dll' pa_modify_accounts() Remote Code Execution
https://notcve.org/view.php?id=CVE-2012-5931
Directory traversal vulnerability in the set_log_config function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname. Vulnerabilidad de salto de directorio en la función set_log_config en regclnt.dll en unifid.exe en NetIQ Privileged User Manager v2.3.x antes de v2.3.1 HF2 permite a usuarios remotos autenticados crear o sobreescribir archivos de su elección a través de secuencias de recorrido de directorio con un nombre de ruta de un fichero de log. • https://www.exploit-db.com/exploits/22737 http://download.novell.com/Download?buildid=K6-PmbPjduA~ http://retrogod.altervista.org/9sg_novell_netiq_i_adv.htm https://www.netiq.com/support/kb/doc.php?id=7011385 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.4EPSS: 1%CPEs: 2EXPL: 3CVE-2012-5930 – Novell NetIQ Privileged User Manager 2.3.1 - 'auth.dll' pa_modify_accounts() Remote Code Execution
https://notcve.org/view.php?id=CVE-2012-5930
The pa_modify_accounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request. La función pa_modify_accounts en auth.dll en unifid.exe en NetIQ Privileged User Manager v2.3.x antes de v2.3.1 HF2 no requiere autenticación para el método modifyAccounts, lo que permite a atacantes remotos cambiar las contraseñas de cuentas administrativas a través de una petición application/x-amf hecha a mano. • https://www.exploit-db.com/exploits/22737 http://download.novell.com/Download?buildid=K6-PmbPjduA~ http://retrogod.altervista.org/9sg_novell_netiq_i.htm http://retrogod.altervista.org/9sg_novell_netiq_i_adv.htm https://www.netiq.com/support/kb/doc.php?id=7011385 • CWE-287: Improper Authentication •