CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Novell : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complex ity Authen tication Confiden tiality Integrity Availa bility
1 CVE-2012-2223 200 +Info 2012-04-11 2012-04-11
4.3
 None Remote Medium Not required Partial None None
The xplat agent in Novell ZENworks Configuration Management (ZCM) 10.3.x before 10.3.4 and 11.x before 11.2 enables the HTTP TRACE method, which might make it easier for remote attackers to conduct cross-site tracing (XST) attacks via unspecified vectors.
2 CVE-2012-2215 22 Dir. Trav. 2012-04-09 2012-04-10
5.0
 None Remote Low Not required Partial None None
Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.
3 CVE-2011-5028 22 Dir. Trav. 2011-12-29 2011-12-30
4.0
 None Remote Low Single system Partial None None
Directory traversal vulnerability in novelllogmanager/FileDownload in Novell Sentinel Log Manager 1.2.0.1_938 and earlier allows remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter.
4 CVE-2011-4194 119 Exec Code Overflow 2012-02-01 2012-02-02
7.5
 None Remote Low Not required Partial Partial Partial
Buffer overflow in Novell iPrint Server in Novell Open Enterprise Server 2 (OES2) through SP3 on Linux allows remote attackers to execute arbitrary code via a crafted attributes-natural-language field.
5 CVE-2011-4191 119 DoS Exec Code Overflow 2011-11-29 2011-11-30
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or cause a denial of service (abend or NFS outage) via long packets.
6 CVE-2011-4189 94 DoS Exec Code Mem. Corr. 2012-03-02 2012-03-05
7.5
 None Remote Low Not required Partial Partial Partial
The client in Novell GroupWise 8.0x through 8.02HP3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via a long e-mail address in an Address Book (aka .NAB) file.
7 CVE-2011-4188 119 DoS Overflow 2012-04-09 2012-04-10
4.0
 None Remote Low Single system None None Partial
Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted EnteredAttrName parameter, a related issue to CVE-2010-1929.
8 CVE-2011-4187 119 Exec Code Overflow 2012-02-21 2012-02-24
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the GetDriverSettings function in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a long realm field, a different vulnerability than CVE-2011-3173.
9 CVE-2011-4186 119 Exec Code Overflow 2012-02-21 2012-02-22
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url, a different vulnerability than CVE-2011-1705.
10 CVE-2011-4185 119 DoS Exec Code Overflow Mem. Corr. 2012-02-21 2012-02-22
10.0
 None Remote Low Not required Complete Complete Complete
The GetPrinterURLList2 method in the ActiveX control in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2008-2431 and CVE-2008-2436.
11 CVE-2011-3179 200 +Info 2011-12-08 2012-03-05
5.0
 None Remote Low Not required Partial None None
The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers to read from arbitrary memory locations via a crafted command.
12 CVE-2011-3176 119 Exec Code Overflow 2012-04-09 2012-04-10
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.
13 CVE-2011-3175 119 Exec Code Overflow 2012-04-09 2012-04-10
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x6c request.
14 CVE-2011-3173 119 Exec Code Overflow 2011-11-29 2011-11-30
7.5
 None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the GetDriverSettings function in nipplib.dll in the iPrint client in Novell Open Enterprise Server 2 (aka OES2) SP3 allows remote attackers to execute arbitrary code via a long (1) hostname or (2) port field.
15 CVE-2011-3014 264 +Info 2011-08-09 2011-09-06
5.0
 None Remote Low Not required Partial None None
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not properly restrict caching of HTTPS responses, which makes it easier for remote attackers to obtain sensitive information by leveraging an unattended workstation.
16 CVE-2011-3013 310 2011-08-09 2011-09-06
5.0
 None Remote Low Not required Partial None None
WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 supports weak SSL ciphers, which makes it easier for remote attackers to obtain access via a brute-force attack.
17 CVE-2011-2750 399 2011-07-17 2011-09-21
5.0
 None Remote Low Not required None None Partial
NFRAgent.exe in Novell File Reporter 1.0.4.2 and earlier allows remote attackers to delete arbitrary files via a full pathname in an SRS OPERATION 4 CMD 5 request to /FSF/CMD.
18 CVE-2011-2663 119 Exec Code Overflow 2011-10-07 2012-05-14
10.0
 None Remote Low Not required Complete Complete Complete
Array index error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted yearly RRULE variable in a VCALENDAR attachment in an e-mail message.
19 CVE-2011-2662 189 Exec Code 2011-10-07 2012-05-14
10.0
 None Remote Low Not required Complete Complete Complete
Integer signedness error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a negative BYWEEKNO property in a weekly RRULE variable in a VCALENDAR attachment in an e-mail message.
20 CVE-2011-2661 79 XSS 2011-10-07 2012-05-14
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities in WebAccess in Novell GroupWise 8.0 before HP3 allow remote attackers to inject arbitrary web script or HTML via the (1) Directory.Item.name or (2) Directory.Item.displayName parameter.
21 CVE-2011-2656 Exec Code 2011-10-24 2012-04-17
9.3
 None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2655.
22 CVE-2011-2655 Exec Code 2011-10-24 2012-03-12
9.3
 None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in ZfHSrvr.exe in Novell ZENworks Handheld Management (ZHM) 7 allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-2656.
23 CVE-2011-2654 20 Exec Code 2011-09-06 2011-10-05
9.3
 None Remote Medium Not required Complete Complete Complete
The RPC implementation in the server in Novell Cloud Manager 1.1.2 before Patch 3 does not properly initialize objects, which allows remote attackers to execute arbitrary code by making RPC calls that leverage incorrect privileges associated with a partially initialized session.
24 CVE-2011-2653 22 Exec Code Dir. Trav. 2011-12-08 2012-03-05
10.0
 None Remote Low Not required Complete Complete Complete
Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by uploading an executable file.
25 CVE-2011-2652 79 XSS 2011-08-23 2011-08-25
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via a crafted archive file list that is used in an overlay file.
26 CVE-2011-2651 Exec Code 2011-08-23 2011-08-25
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the file browser in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename.
27 CVE-2011-2650 79 XSS 2011-08-23 2011-08-25
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via a crafted pattern name that is included in an RPM info display.
28 CVE-2011-2649 20 Exec Code 2011-08-23 2011-08-25
7.5
 None Remote Low Not required Partial Partial Partial
Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to execute arbitrary commands via shell metacharacters in an unspecified FileUtils function call.
29 CVE-2011-2648 Exec Code 2011-08-23 2011-08-25
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a filter in a modified file.
30 CVE-2011-2647 Exec Code 2011-08-23 2011-08-25
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted archive name in the list of testdrive modified files.
31 CVE-2011-2646 Exec Code 2011-08-23 2011-08-25
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename in the list of testdrive modified files.
32 CVE-2011-2645 Exec Code 2011-08-23 2011-08-25
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to execute arbitrary code via a crafted filename for a custom RPM.
33 CVE-2011-2644 79 XSS 2011-08-23 2011-08-25
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to an RPM info display.
34 CVE-2011-2227 79 XSS 2011-10-07 2011-11-21
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Novell Identity Manager (aka IDM) User Application 3.5.0, 3.5.1, 3.6.0, 3.6.1, 3.7.0, and 4.0.0, and Identity Manager Roles Based Provisioning Module 3.6.0, 3.6.1, 3.7.0, and 4.0.0, allows remote attackers to inject arbitrary web script or HTML via the apwaDetail (aka apwaDetailId) parameter, aka Bug 709603.
35 CVE-2011-2226 79 XSS 2011-08-23 2011-08-25
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a pattern listing.
36 CVE-2011-2225 2011-08-23 2011-08-25
9.3
 None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Kiwi before 3.74.2, as used in SUSE Studio 1.1 before 1.1.4, allows attackers to have an unknown impact via a crafted directory pathname that is inserted into config.sh.
37 CVE-2011-2224 79 XSS 2011-08-09 2011-08-10
4.3
 None Remote Medium Not required None Partial None
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
38 CVE-2011-2223 310 +Info 2011-08-09 2011-08-10
5.0
 None Remote Low Not required Partial None None
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 sends the Admin LDAP password in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
39 CVE-2011-2222 2011-08-09 2011-08-10
4.3
 None Remote Medium Not required None Partial None
Session fixation vulnerability in WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to hijack web sessions via unspecified vectors.
40 CVE-2011-2221 264 Bypass +Info 2011-08-09 2011-08-10
5.0
 None Remote Low Not required Partial None None
The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to bypass WebAdmin authentication and obtain sensitive GroupWise information via unspecified vectors.
41 CVE-2011-2220 119 Exec Code Overflow 2011-07-14 2011-09-21
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in NFREngine.exe in Novell File Reporter Engine before 1.0.2.53, as used in Novell File Reporter and other products, allows remote attackers to execute arbitrary code via a crafted RECORD element.
42 CVE-2011-2219 DoS 2011-10-07 2012-05-14
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, a different vulnerability than CVE-2011-2218.
43 CVE-2011-2218 DoS 2011-10-07 2012-05-14
5.0
 None Remote Low Not required None None Partial
Unspecified vulnerability in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, a different vulnerability than CVE-2011-2219.
44 CVE-2011-1711 2011-06-08 2011-09-06
5.5
 None Remote Low Single system Partial Partial None
Unspecified vulnerability in the Mobility Pack 1.1.2 and earlier in Novell Data Synchronizer 1.0.x, and 1.1.x through 1.1.1 build 428, allows remote authenticated users to access the accounts of other users via unknown vectors.
45 CVE-2011-1710 189 DoS Exec Code Overflow 2011-12-30 2012-01-02
7.5
 None Remote Low Not required Partial Partial Partial
Multiple integer overflows in the HTTP server in the Novell XTier framework 3.1.8 allow remote attackers to cause a denial of service (service crash) or possibly execute arbitrary code via crafted header length variables.
46 CVE-2011-1708 119 Exec Code Overflow 2011-06-09 2011-09-06
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted op-printer-list-all-jobs cookie.
47 CVE-2011-1707 119 Exec Code Overflow 2011-06-09 2011-09-06
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted op-printer-list-all-jobs parameter in a printer-url.
48 CVE-2011-1706 119 Exec Code Overflow 2011-06-09 2011-09-06
9.3
 None Remote Medium Not required Complete Complete Complete
Stack-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted iprint-client-config-info parameter in a printer-url.
49 CVE-2011-1705 119 Exec Code Overflow 2011-06-09 2011-09-06
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url.
50 CVE-2011-1704 119 Exec Code Overflow 2011-06-09 2011-09-06
9.3
 None Remote Medium Not required Complete Complete Complete
Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.64 allows remote attackers to execute arbitrary code via a crafted core-package parameter in a printer-url.
Total number of vulnerabilities : 398   Page : 1 (This Page)2 3 4 5 6 7 8
CVE is a registred trademark of the MITRE Corporation and the authoritive source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritive source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritive source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.