Novell Filr vulnerabilities
6 CVEs affecting Novell Filr, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-1611, published 2016-08-01.
More from Novell.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2016-1610, published 2016-08-01. High severity, CVSS 7.5. EPSS: 11.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access…
- CVE-2016-1608, published 2016-08-01. High severity, CVSS 8.8. EPSS: 11.3% chance of exploitation in the next 30 days. vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer…
- CVE-2016-1607, published 2016-08-01. High severity, CVSS 7.2. EPSS: 3.4% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of…
- CVE-2016-1609, published 2016-08-01. Medium severity, CVSS 5.4. EPSS: 3.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or…
- CVE-2016-1611, published 2016-08-01. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. Novell Filr 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 uses world-writable permissions for /etc/profile.d/vainit.sh, which allows local users to gain privileges by replacing this file's…
- CVE-2015-5968, published 2016-03-18. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Novell Filr 1.2 before Hot Patch 4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.