Novell Imanager vulnerabilities

16 CVEs affecting Novell Imanager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-7432, published 2017-05-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-1929, published 2010-06-28. High severity, CVSS 9.0. EPSS: 16.1% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in the jclient._Java_novell_jclient_JClient_defineClass@20 function in jclient.dll in the Tomcat web server in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allow…
CVE-2004-0112, published 2004-11-23. Medium severity, CVSS 5.0. EPSS: 10.4% chance of exploitation in the next 30 days. The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote…
CVE-2004-0079, published 2004-11-23. High severity, CVSS 7.5. EPSS: 9.5% chance of exploitation in the next 30 days. The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null…
CVE-2010-1930, published 2010-06-28. Medium severity, CVSS 5.0. EPSS: 8.3% chance of exploitation in the next 30 days. Off-by-one error in Novell iManager 2.7, 2.7.3, and 2.7.3 FTF2 allows remote attackers to cause a denial of service (daemon crash) via a long tree parameter in a login request to nps/servlet/webacc.
CVE-2004-0081, published 2004-11-23. Medium severity, CVSS 5.0. EPSS: 7.2% chance of exploitation in the next 30 days. OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test…
CVE-2005-1730, published 2005-12-31. High severity, CVSS 9.3. EPSS: 4.8% chance of exploitation in the next 30 days. Multiple vulnerabilities in the OpenSSL ASN.1 parser, as used in Novell iManager 2.0.2, allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted packets, as…
CVE-2009-4486, published 2010-01-08. High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days. Stack-based buffer overflow in the eDirectory plugin in Novell iManager before 2.7.3 allows remote attackers to execute arbitrary code via vectors that trigger long arguments to an unspecified…
CVE-2006-4517, published 2006-11-01. High severity, CVSS 7.8. EPSS: 3.2% chance of exploitation in the next 30 days. Novell iManager 2.5 and 2.0.2 allows remote attackers to cause a denial of service (crash) in the Tomcat server via a long TREE parameter in an HTTP POST, which triggers a NULL pointer dereference.
CVE-2013-3268, published 2013-04-24. High severity, CVSS 10.0. EPSS: 1.6% chance of exploitation in the next 30 days. Novell iManager 2.7 before SP6 Patch 1 does not refresh a token after a logout action, which has unspecified impact and remote attack vectors.
CVE-2017-7432, published 2017-05-03. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability.

Latest

CVE-2017-7431, published 2017-05-03. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management.
CVE-2017-7430, published 2017-05-03. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework.
CVE-2017-5186, published 2017-04-27. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Novell iManager 2.7 before SP7 Patch 9, NetIQ iManager 3.x before 3.0.2.1, Novell eDirectory 8.8.x before 8.8 SP8 Patch 9 Hotfix 2, and NetIQ eDirectory 9.x before 9.0.2 Hotfix 2 (9.0.2.2) use the…
CVE-2013-1088, published 2013-04-24. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request…
CVE-2011-4188, published 2012-04-09. Medium severity, CVSS 4.0. EPSS: 1.5% chance of exploitation in the next 30 days. Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have…