CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Novell » Netware : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2011-4191 119 DoS Exec Code Overflow 2011-11-29 2011-11-30
7.5
None Remote Low Not required Partial Partial Partial
Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or cause a denial of service (abend or NFS outage) via long packets.
2 CVE-2010-4228 119 DoS Exec Code Overflow 2011-03-22 2011-09-21
9.0
None Remote Low Single system Complete Complete Complete
Stack-based buffer overflow in NWFTPD.NLM before 5.10.02 in the FTP server in Novell NetWare allows remote authenticated users to execute arbitrary code or cause a denial of service (abend) via a long DELE command, a different vulnerability than CVE-2010-0625.4.
3 CVE-2010-0625 119 DoS Exec Code Overflow 2010-04-05 2010-04-17
6.5
None Remote Low Single system Partial Partial Partial
Stack-based buffer overflow in NWFTPD.nlm before 5.10.01 in the FTP server in Novell NetWare 5.1 through 6.5 SP8 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long (1) MKD, (2) RMD, (3) RNFR, or (4) DELE command.
4 CVE-2010-0317 399 1 DoS 2010-01-15 2011-08-08
7.8
None Remote Low Not required None None Complete
Novell Netware 6.5 SP8 allows remote attackers to cause a denial of service (NULL pointer dereference, memory consumption, ABEND, and crash) via a large number of malformed or AFP requests that are not properly handled by (1) the CIFS functionality in CIFS.nlm Semantic Agent (Build 163 MP) 3.27 or (2) the AFP functionality in AFPTCP.nlm Build 163 SP 3.27. NOTE: some of these details are obtained from third party information.
5 CVE-2008-5696 255 2008-12-19 2009-08-12
9.3
Admin Remote Medium Not required Complete Complete Complete
Novell NetWare 6.5 before Support Pack 8, when an OES2 Linux server is installed into the NDS tree, does not require a password for the ApacheAdmin console, which allows remote attackers to reconfigure the Apache HTTP Server via console operations.
6 CVE-2007-6735 264 Bypass 2010-04-05 2010-04-06
7.5
None Remote Low Not required Partial Partial Partial
NWFTPD.nlm before 5.08.06 in the FTP server in Novell NetWare does not properly handle partial matches for container names in the FTPREST.TXT file, which allows remote attackers to bypass intended access restrictions via an FTP session.
7 CVE-2007-6734 264 2010-04-05 2010-04-06
4.0
None Remote Low Single system Partial None None
NWFTPD.nlm before 5.08.07 in the FTP server in Novell NetWare 6.5 SP7 does not properly implement the FTPREST.TXT NOREMOTE restriction, which allows remote authenticated users to access directories outside of the home server via unspecified vectors.
8 CVE-2006-6675 XSS 2006-12-20 2008-09-05
6.8
User Remote Medium Not required Partial Partial Partial
Cross-site scripting (XSS) vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecifeid parameters in Welcome web-app.
9 CVE-2006-2327 189 Exec Code Overflow 2006-05-11 2011-10-11
6.4
None Remote Low Not required None Partial Partial
Multiple integer overflows in the DPRPC library (DPRPCNLM.NLM) NDPS/iPrint module in Novell Distributed Print Services in Novell NetWare 6.5 SP3, SP4, and SP5 allow remote attackers to execute arbitrary code via an XDR encoded array with a field that specifies a large number of elements, which triggers the overflows in the ndps_xdr_array function.
10 CVE-2006-2185 +Priv 2006-05-22 2008-09-05
4.0
None Remote Low Single system Partial None None
PORTAL.NLM in Novell Netware 6.5 SP5 writes the username and password in cleartext to the abend.log log file when the groupOperationsMethod function fails, which allows context-dependent attackers to gain privileges.
11 CVE-2006-1322 DoS Overflow 2006-03-20 2008-09-05
5.0
None Remote Low Not required None None Partial
Novell Netware NWFTPD 5.06.05 allows remote attackers to cause a denial of service (ABEND) via an MDTM command that uses a long path for the target file, possibly due to a buffer overflow.
12 CVE-2006-0999 2006-03-23 2014-01-16
5.0
None Remote Low Not required Partial None None
The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) allows a client to force the server to use weak encryption by stating that a weak cipher is required for client compatibility, which might allow remote attackers to decrypt contents of an SSL protected session.
13 CVE-2006-0998 2006-03-23 2014-01-16
5.0
None Remote Low Not required Partial None None
The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) sometimes selects a weak cipher instead of an available stronger cipher, which makes it easier for remote attackers to sniff and decrypt an SSL protected session.
14 CVE-2006-0997 2006-03-23 2008-09-05
5.0
None Remote Low Not required Partial None None
The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) permits encryption with a NULL key, which results in cleartext communication that allows remote attackers to read an SSL protected session by sniffing network traffic.
15 CVE-2005-4888 DoS 2010-04-05 2010-04-06
5.0
None Remote Low Not required None None Partial
NWFTPD.nlm before 5.06.04 in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (excessive stale connections) by establishing many FTP sessions, which persist in the Not-Logged-In state after each session is completed.
16 CVE-2005-4887 2010-04-05 2010-04-06
7.5
None Remote Low Not required Partial Partial Partial
NWFTPD.nlm before 5.06.05 in the FTP server in Novell NetWare 6.5 SP5 allows attackers to have an unspecified impact via vectors related to passwords.
17 CVE-2005-2852 DoS 2005-09-08 2008-09-05
5.0
None Remote Low Not required None None Partial
Unknown vulnerability in CIFS.NLM in Novell Netware 6.5 SP2 and SP3, 5.1, and 6.0 allows remote attackers to cause a denial of service (ABEND) via an incorrect password length, as exploited by the "worm.rbot.ccc" worm.
18 CVE-2005-1060 DoS 2005-05-02 2008-09-05
5.0
None Remote Low Not required None None Partial
Unknown vulnerability in the TCP/IP functionality (TCPIP.NLM) in Novell Netware 6.x allows remote attackers to cause a denial of service (ABEND by Page Fault Processor Exception) via certain packets.
19 CVE-2005-0819 2005-05-02 2008-09-05
5.0
None Remote Low Not required None Partial None
The xvesa code in Novell Netware 6.5 SP2 and SP3 allows remote attackers to redirect the xsession without authentication via a direct request to GUIMirror/Start.
20 CVE-2004-2767 264 DoS 2010-04-05 2010-04-06
4.3
None Remote Medium Not required None None Partial
NWFTPD.nlm before 5.04.25 in the FTP server in Novell NetWare does not promptly close DS sessions, which allows remote attackers to cause a denial of service (connection slot exhaustion) by establishing many FTP sessions that persist for the lifetime of a DS session.
21 CVE-2004-2734 287 Bypass 2004-12-31 2008-09-05
10.0
Admin Remote Low Not required Complete Complete Complete
webadmin-apache.conf in Novell Web Manager of Novell NetWare 6.5 uses an uppercase Alias tag with an inconsistent lowercase directory tag for a volume, which allows remote attackers to bypass access control to the WEB-INF folder.
22 CVE-2004-2414 +Info 2004-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
Novell NetWare 6.5 SP 1.1, when installing or upgrading using the Overlay CDs and performing a custom installation with OpenSSH, includes sensitive password information in the (1) NIOUTPUT.TXT and (2) NI.LOG log files, which might allow local users to obtain the passwords.
23 CVE-2004-2336 2004-12-31 2008-09-05
5.0
None Remote Low Not required Partial None None
Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, allows remote attackers to read directories and files on the server.
24 CVE-2003-1596 264 Bypass 2010-04-05 2010-06-08
7.5
None Remote Low Not required Partial Partial Partial
NWFTPD.nlm before 5.03.12 in the FTP server in Novell NetWare does not properly restrict filesystem use by anonymous users with NFS Gateway home directories, which allows remote attackers to bypass intended access restrictions via an FTP session.
25 CVE-2003-1595 264 2010-04-05 2010-04-06
10.0
None Remote Low Not required Complete Complete Complete
NWFTPD.nlm before 5.04.05 in the FTP server in Novell NetWare 6.5 does not properly perform "intruder detection," which has unspecified impact and attack vectors.
26 CVE-2003-1594 264 Bypass 2010-04-05 2010-04-06
7.5
None Remote Low Not required Partial Partial Partial
NWFTPD.nlm before 5.04.05 in the FTP server in Novell NetWare 6.5 does not properly enforce FTPREST.TXT settings, which allows remote attackers to bypass intended access restrictions via an FTP session.
27 CVE-2003-1593 264 Bypass 2010-04-05 2010-04-06
7.5
None Remote Low Not required Partial Partial Partial
NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 does not enforce domain-name login restrictions, which allows remote attackers to bypass intended access control via an FTP connection.
28 CVE-2003-1592 119 DoS Overflow 2010-04-05 2010-04-06
5.0
None Remote Low Not required None None Partial
Multiple buffer overflows in NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 allow remote attackers to cause a denial of service (abend) via a long (1) username or (2) password.
29 CVE-2003-1591 DoS 2010-04-05 2010-06-08
4.3
None Remote Medium Not required None None Partial
NWFTPD.nlm in the FTP server in Novell NetWare 6.0 before SP4 and 6.5 before SP1 allows user-assisted remote attackers to cause a denial of service (console hang) via a large number of FTP sessions, which are not properly handled during an NLM unload.
30 CVE-2003-1150 DoS Exec Code Overflow 2003-10-27 2008-09-05
7.5
None Remote Low Not required Partial Partial Partial
Buffer overflow in the portmapper service (PMAP.NLM) in Novell NetWare 6 SP3 and ZenWorks for Desktops 3.2 SP2 through 4.0.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via unknown attack vectors.
31 CVE-2003-0976 2003-12-15 2008-09-10
7.5
User Remote Low Not required Partial Partial Partial
NFS Server (XNFS.NLM) for Novell NetWare 6.5 does not properly enforce sys:\etc\exports when hostname aliases from sys:etc\hosts file are used, which could allow users to mount file systems when XNFS should deny the host.
32 CVE-2003-0562 DoS Overflow 2003-08-27 2008-09-10
5.0
None Remote Low Not required None None Partial
Buffer overflow in the CGI2PERL.NLM PERL handler in Novell Netware 5.1 and 6.0 allows remote attackers to cause a denial of service (ABEND) via a long input string.
33 CVE-2002-2434 DoS 2010-04-05 2010-06-08
5.0
None Remote Low Not required None None Partial
NWFTPD.nlm before 5.02i in the FTP server in Novell NetWare does not properly listen for data connections, which allows remote attackers to cause a denial of service (abend) via multiple FTP sessions.
34 CVE-2002-2433 20 DoS 2010-04-05 2010-06-08
4.0
None Remote Low Single system None None Partial
NWFTPD.nlm before 5.03b in the FTP server in Novell NetWare allows remote authenticated users to cause a denial of service (abend) via a crafted ABOR command.
35 CVE-2002-2432 DoS 2010-04-05 2010-04-05
5.0
None Remote Low Not required None None Partial
Unspecified vulnerability in NWFTPD.nlm before 5.03b in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (abend) via a crafted username.
36 CVE-2002-2096 Exec Code Overflow 2002-12-31 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
Buffer overflow in Novell Remote Manager module, httpstk.nlm, in NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary code via a long (1) username or (2) password.
37 CVE-2002-2083 Bypass 2002-12-31 2008-09-05
2.1
None Local Low Not required Partial None None
The Novell Netware client running on Windows 95 allows local users to bypass the login and open arbitrary files via the "What is this?" help feature, which can be launched from the Novell Netware login screen.
38 CVE-2002-1772 2002-12-31 2008-09-05
4.6
User Local Low Not required Partial Partial Partial
Novell Netware 5.0 through 5.1 may allow local users to gain "Domain Admin" rights by logging into a Novell Directory Services (NDS) account, and executing "net use" on an NDS_ADM account that is not in the NT domain but has domain access rights, which allows the user to enter a null password.
39 CVE-2002-1634 +Info 2002-12-31 2008-09-05
5.0
None Remote Low Not required Partial None None
Novell NetWare 5.1 installs sample applications that allow remote attackers to obtain sensitive information via (1) ndsobj.nlm, (2) allfield.jse, (3) websinfo.bas, (4) ndslogin.pl, (5) volscgi.pl, (6) lancgi.pl, (7) test.jse, or (8) env.pl.
40 CVE-2002-1438 +Info 2003-04-11 2008-09-05
5.0
None Remote Low Not required Partial None None
The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to obtain Perl version information via the -v option.
41 CVE-2002-1437 Dir. Trav. 2003-04-11 2008-09-05
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in the web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to read arbitrary files via an HTTP request containing "..%5c" (URL-encoded dot-dot backslash) sequences.
42 CVE-2002-1436 Exec Code 2003-04-11 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
The web handler for Perl 5.003 on Novell NetWare 5.1 and NetWare 6 allows remote attackers to execute arbitrary Perl code via an HTTP POST request.
43 CVE-2002-1418 DoS Overflow 2003-04-11 2008-09-05
5.0
None Remote Low Not required None None Partial
Buffer overflow in the interpreter for Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to cause a denial of service (ABEND) via a long module name.
44 CVE-2002-1417 Dir. Trav. 2003-04-11 2008-09-05
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in Novell NetBasic Scripting Server (NSN) for Netware 5.1 and 6, and Novell Small Business Suite 5.1 and 6, allows remote attackers to read arbitrary files via a URL containing a "..%5c" sequence (modified dot-dot), which is mapped to the directory separator.
45 CVE-2002-1413 Bypass 2003-04-11 2008-09-05
7.5
User Remote Low Not required Partial Partial Partial
RCONAG6 for Novell Netware SP2, while running RconJ in secure mode, allows remote attackers to bypass authentication using the RconJ "Secure IP" (SSL) option during a connection.
46 CVE-2002-0930 DoS 2002-10-04 2008-09-05
5.0
None Remote Low Not required None None Partial
Format string vulnerability in the FTP server for Novell Netware 6.0 SP1 (NWFTPD) allows remote attackers to cause a denial of service (ABEND) via format strings in the USER command.
47 CVE-2002-0929 DoS Overflow 2002-10-04 2008-09-05
5.0
None Remote Low Not required None None Partial
Buffer overflows in the DHCP server for NetWare 6.0 SP1 allow remote attackers to cause a denial of service (reboot) via long DHCP requests.
48 CVE-2002-0791 DoS 2002-08-12 2008-09-05
5.0
None Remote Low Not required None None Partial
Novell Netware FTP server NWFTPD before 5.02r allows remote attackers to cause a denial of service (CPU consumption) via a connection to the server followed by a carriage return, and possibly other invalid commands with improper syntax or length.
49 CVE-2001-1587 119 DoS Overflow 2010-04-05 2010-04-05
5.0
None Remote Low Not required None None Partial
NWFTPD.nlm before 5.01w in the FTP server in Novell NetWare allows remote attackers to cause a denial of service (abend) via an anonymous STOU command.
50 CVE-2001-1580 Dir. Trav. 2001-12-31 2008-09-05
5.0
None Remote Low Not required Partial None None
Directory traversal vulnerability in ScriptEase viewcode.jse for Netware 5.1 before 5.1 SP3 allows remote attackers to read arbitrary files via ".." sequences in the query string.
Total number of vulnerabilities : 65   Page : 1 (This Page)2
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.