Novell Mobility Pack vulnerabilities

7 CVEs affecting Novell Mobility Pack, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-3014, published 2011-08-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2011-2223, published 2011-08-09. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 sends the Admin LDAP password in cleartext, which allows remote attackers to obtain sensitive information by…
CVE-2011-2221, published 2011-08-09. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to bypass WebAdmin authentication and obtain sensitive GroupWise information via…
CVE-2011-1711, published 2011-06-09. Medium severity, CVSS 5.5. EPSS: 1.3% chance of exploitation in the next 30 days. Unspecified vulnerability in the Mobility Pack 1.1.2 and earlier in Novell Data Synchronizer 1.0.x, and 1.1.x through 1.1.1 build 428, allows remote authenticated users to access the accounts of…
CVE-2011-3014, published 2011-08-09. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not properly restrict caching of HTTPS responses, which makes it easier for remote attackers to obtain…
CVE-2011-3013, published 2011-08-09. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 supports weak SSL ciphers, which makes it easier for remote attackers to obtain access via a…
CVE-2011-2222, published 2011-08-09. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Session fixation vulnerability in WebAdmin in the Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 allows remote attackers to hijack web sessions via unspecified…
CVE-2011-2224, published 2011-08-09. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. The Mobility Pack before 1.2 in Novell Data Synchronizer 1.x through 1.1.2 build 428 does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to conduct…