CVE-2016-1610

Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. dot dot in a blob name...

CVE-2016-1607

CVE-2016-1607 affects Micro Focus (Novell) Filr; multiple CSRF flaws in the administrative interface allow remote attackers to hijack administrator sessions by reconfiguring time settings via vaconfig/time. The issue impacts Filr versions up to 2.0 Security Update 2 and earlier; a SEC Consult adv...

CVE-2016-1611

Novell Filr 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 uses world-writable permissions for /etc/profile.d/vainit.sh, which allows local users to gain privileges by replacing this file's content with arbitrary shell commands...

CVE-2016-1607

Multiple cross-site request forgery CSRF vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request...

CVE-2016-1611

CVE-2016-1611 affects Micro Focus (Novell) Filr 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2. The issue is world-writable permissions on /etc/profile.d/vainit.sh, allowing a local user to replace the file and gain privileges (local privilege escalation). Affected versions include Filr 1.2 an...

CVE-2016-1608

vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer parameter...

CVE-2016-1610

CVE-2016-1610 affects Micro Focus/Novell Filr (email-template feature) prior to 1.2 Security Update 3 and 2.0 Security Update 2. A directory traversal flaw allows an attacker to bypass access controls and write arbitrary files via a .. in a blob name. Impact details in the sources indicate potent...

CVE-2016-1609

Multiple cross-site scripting XSS vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input, as demonstrated by a crafted attribute of an IMG element in the phone field of ...

CVE-2016-1608

CVE-2016-1608 affects Micro Focus (Novell) Filr appliances. The vulnerability allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer parameter of vaconfig/time. Affected are Filr 1.2 up to 1.2.0.846 and Filr 2 up to 2.0.0.421, with fixes in Filr ...

PT-2016-4885

Name of the Vulnerable Software and Affected Versions Novell Filr versions prior to 2.0 Security Update 2 Description The issue allows remote attackers to hijack the authentication of administrators. This can be demonstrated by reconfiguring time settings via a "vaconfig/time" request...

PT-2016-4886

Name of the Vulnerable Software and Affected Versions Novell Filr versions prior to 1.2 Security Update 3 Novell Filr versions 2.0 prior to Security Update 2 Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer parameter...

PT-2016-4888

Name of the Vulnerable Software and Affected Versions Novell Filr versions prior to 1.2 Security Update 3 Novell Filr versions 2.0 prior to Security Update 2 Description The issue allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. dot dot in a blo...

PT-2016-4889

Name of the Vulnerable Software and Affected Versions Novell Filr versions 1.2 before Hot Patch 6 Novell Filr versions 2.0 before Hot Patch 2 Description The issue allows local users to gain privileges by replacing the content of a specific file with arbitrary shell commands, due to world-writabl...

PT-2016-4887

Name of the Vulnerable Software and Affected Versions Novell Filr versions prior to 1.2 Security Update 3 Novell Filr versions prior to 2.0 Security Update 2 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via crafted input. This can be demonstrated ...

CVE-2016-1611: Undefined Security Weakness

Novell Filr 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 uses world-writable permissions for /etc/profile.d/vainit.sh, which allows local users to gain privileges by replacing this file's content with arbitrary shell commands...

CVE-2016-1607: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request...

CVE-2016-1610: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. dot dot in a blob name...

CVE-2016-1609: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input, as demonstrated by a crafted attribute of an IMG element in the phone field of ...

CVE-2016-1608: Improper Access Control

vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer parameter...

Micro Focus Filr 2 2.0.0.4211.2 1.2.0.846 - Multiple Vulnerabilities

Micro Focus Filr 2 2.0.0.4211.2 1.2.0.846 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: Micro Focus former Novell Filr Appliance vulnerable version: Filr 2...