Novell Suse Lifecycle Management Server vulnerabilities

5 CVEs affecting Novell Suse Lifecycle Management Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-0993, published 2014-04-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-3710, published 2013-12-10. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. SUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms…
CVE-2010-1325, published 2010-09-03. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the…
CVE-2013-3709, published 2013-12-23. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.
CVE-2011-0993, published 2014-04-16. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.
CVE-2013-7042, published 2013-12-10. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. SUSE Lifecycle Management Server (SLMS) before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via unspecified vectors.