Novell Service Desk vulnerabilities

4 CVEs affecting Novell Service Desk, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-1596, published 2016-04-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-1593, published 2016-04-22. High severity, CVSS 7.2. EPSS: 64.1% chance of exploitation in the next 30 days. Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a…
CVE-2016-1594, published 2016-04-22. Medium severity, CVSS 6.5. EPSS: 6.9% chance of exploitation in the next 30 days. Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via…
CVE-2016-1595, published 2016-04-22. Medium severity, CVSS 6.5. EPSS: 6.6% chance of exploitation in the next 30 days. LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to conduct Hibernate Query Language (HQL) injection…
CVE-2016-1596, published 2016-04-22. Medium severity, CVSS 5.4. EPSS: 2.4% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain (1) user name,…