Vulnerabilities > Novell > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2011-04-10 | CVE-2011-0466 | Permissions, Privileges, and Access Controls vulnerability in Novell Opensuse Build Service The API in SUSE openSUSE Build Service (OBS) 2.0.x before 2.0.8 and 2.1.x before 2.1.6 allows attackers to bypass intended write-access restrictions and modify a (1) package or (2) project via unspecified vectors. | 6.4 |
| 2011-04-10 | CVE-2011-0462 | Cross-Site Scripting vulnerability in Novell Opensuse Build Service Multiple cross-site scripting (XSS) vulnerabilities in the login page in the webui component in SUSE openSUSE Build Service (OBS) before 2.1.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2011-03-30 | CVE-2011-1551 | Permissions, Privileges, and Access Controls vulnerability in Novell Opensuse Factory SUSE openSUSE Factory assigns ownership of the /var/log/cobbler/ directory tree to the web-service user account, which might allow local users to gain privileges by leveraging access to this account during root filesystem operations by the Cobbler daemon. | 6.9 |
| 2011-03-30 | CVE-2011-1550 | Permissions, Privileges, and Access Controls vulnerability in Gentoo Logrotate The default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories for the (1) cobbler, (2) inn, (3) safte-monitor, and (4) uucp packages. | 6.3 |
| 2011-02-10 | CVE-2010-4327 | Denial Of Service vulnerability in Novell eDirectory Server NCP Requests Unspecified vulnerability in the NCP service in Novell eDirectory 8.8.5 before 8.8.5.6 and 8.8.6 before 8.8.6.2 allows remote attackers to cause a denial of service (hang) via a malformed FileSetLock request to port 524. | 5.0 |
| 2011-01-31 | CVE-2010-4717 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Novell Groupwise Multiple stack-based buffer overflows in the IMAP server component in GroupWise Internet Agent (GWIA) in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long (1) LIST or (2) LSUB command. | 6.5 |
| 2011-01-31 | CVE-2010-4716 | Cross-Site Scripting vulnerability in Novell Groupwise Cross-site scripting (XSS) vulnerability in the WebPublisher component in Novell GroupWise before 8.02HP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2011-01-31 | CVE-2010-4715 | Path Traversal vulnerability in Novell Groupwise Multiple directory traversal vulnerabilities in the (1) WebAccess Agent and (2) Document Viewer Agent components in Novell GroupWise before 8.02HP allow remote attackers to read arbitrary files via unspecified vectors. | 5.0 |
| 2011-01-28 | CVE-2010-2779 | Cross-Site Scripting vulnerability in Novell Groupwise 8.0 Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise 8.x before 8.0 SP2 allows remote attackers to inject arbitrary web script or HTML via a crafted message, related to "replies." | 4.3 |
| 2011-01-28 | CVE-2010-2778 | Cross-Site Scripting vulnerability in Novell Groupwise 7.0/8.0 Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise 7.x before 7.0 post-SP4 FTF and 8.x before 8.0 SP2 allows remote attackers to inject arbitrary web script or HTML via a crafted message, related to a "Javascript XSS exploit." | 4.3 |