Novell Open Enterprise Server vulnerabilities

20 CVEs affecting Novell Open Enterprise Server, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-2016, published 2019-12-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 100% chance of exploitation in the next 30 days. GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,…
CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-25. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 99.9% chance of exploitation in the next 30 days. GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or…
CVE-2006-0736, published 2006-02-27. High severity, CVSS 10.0. EPSS: 7.1% chance of exploitation in the next 30 days. Stack-based buffer overflow in the pam_micasa PAM authentication module in CASA on Novell Linux Desktop 9 and Open Enterprise Server 1 allows remote attackers to execute arbitrary code via…
CVE-2005-3655, published 2005-12-31. High severity, CVSS 7.5. EPSS: 5.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in Novell Open Enterprise Server Remote Manager (novell-nrm) in Novell SUSE Linux Enterprise Server 9 allows remote attackers to execute arbitrary code via an HTTP POST…
CVE-2008-5021, published 2008-11-13. High severity, CVSS 9.3. EPSS: 3.6% chance of exploitation in the next 30 days. nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash)…
CVE-2006-0998, published 2006-03-23. Medium severity, CVSS 5.0. EPSS: 3.2% chance of exploitation in the next 30 days. The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) sometimes selects a weak cipher instead of an available stronger cipher, which makes it easier…
CVE-2017-5182, published 2017-01-23. High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days. Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file, via a specially crafted URL, that allows complete directory traversal and total…
CVE-2011-4194, published 2012-02-02. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. Buffer overflow in Novell iPrint Server in Novell Open Enterprise Server 2 (OES2) through SP3 on Linux allows remote attackers to execute arbitrary code via a crafted attributes-natural-language…
CVE-2014-0598, published 2014-06-18. High severity, CVSS 10.0. EPSS: 2.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux has unspecified impact and remote attack vectors.
CVE-2006-0999, published 2006-03-23. Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days. The SSL server implementation in NILE.NLM in Novell NetWare 6.5 and Novell Open Enterprise Server (OES) allows a client to force the server to use weak encryption by stating that a weak cipher is…

Latest

CVE-2013-2016, published 2019-12-30. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space,…
CVE-2014-0609, published 2014-08-17. High severity, CVSS 10.0. EPSS: 2.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Novell Open Enterprise Server (OES) 11 SP1 before Scheduled Maintenance Update 9415 and 11 SP2 before Scheduled Maintenance Update 9413 for Linux has unknown impact and…
CVE-2014-0599, published 2014-06-18. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in iPrint in Novell Open Enterprise Server (OES) 11 SP1 before Maintenance Update 9151 on Linux allows remote attackers to inject arbitrary web script or HTML…
CVE-2014-0595, published 2014-05-08. Low severity, CVSS 2.6. EPSS: 0.3% chance of exploitation in the next 30 days. /opt/novell/ncl/bin/nwrights in Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2 does not properly manage a certain array, which allows local users to obtain the S…
CVE-2013-3707, published 2013-12-01. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. The HTTPSTK service in the novell-nrm package before 2.0.2-297.305.302.3 in Novell Open Enterprise Server 2 (OES 2) Linux, and OES 11 Linux Gold and SP1, does not make the intended SSL_free and…