PT-2012-2558

Name of the Vulnerable Software and Affected Versions NetIQ eDirectory versions 8.8.6.x through 8.8.6.6 NetIQ eDirectory versions 8.8.7.x through 8.8.7.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2012-2560

Name of the Vulnerable Software and Affected Versions NetIQ eDirectory versions 8.8.6.x through 8.8.6.6 NetIQ eDirectory versions 8.8.7.x through 8.8.7.1 Description The issue allows remote attackers to obtain an administrator cookie and bypass authorization checks. Recommendations For NetIQ...

CVE-2012-0432: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors...

CVE-2012-0430: Undefined Security Weakness

Unspecified vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote attackers to obtain an administrator cookie and bypass authorization checks via unknown vectors...

VulnCheck KEV: CVE-2012-0432

Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors...

CVE-2012-0428: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-0429: Undefined Security Weakness

dhost in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote authenticated users to cause a denial of service daemon crash via crafted characters in an HTTP request...

CVE-2012-5930

The pamodifyaccounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request...

CVE-2012-5931

Directory traversal vulnerability in the setlogconfig function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname...

CVE-2012-5932

Eval injection vulnerability in the ldapagnteval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request...

Cross site request forgery (csrf)

The pamodifyaccounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request...

Directory traversal

Directory traversal vulnerability in the setlogconfig function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname...

Sql injection

Eval injection vulnerability in the ldapagnteval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request...

CVE-2012-5930

The pamodifyaccounts function in auth.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 does not require authentication for the modifyAccounts method, which allows remote attackers to change the passwords of administrative accounts via a crafted application/x-amf request...

CVE-2012-5931

Directory traversal vulnerability in the setlogconfig function in regclnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote authenticated users to create or overwrite arbitrary files via directory traversal sequences in a log pathname...

CVE-2012-5932

Eval injection vulnerability in the ldapagnteval function in ldapagnt.dll in unifid.exe in NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2 allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request...

CVE-2012-5930

The CVE-2012-5930 entry concerns NetIQ Privileged User Manager (PUM) 2.3.x prior to 2.3.1 HF2. The pa_modify_accounts function in auth.dll (unifid.exe) does not require authentication for modifyAccounts, allowing remote attackers to change administrative passwords via a crafted application/x-amf ...

CVE-2012-5931

CVE-2012-5931 is a directory traversal vulnerability affecting NetIQ Privileged User Manager 2.3.x before 2.3.1 HF2. The flaw exists in the set_log_config function of regclnt.dll (unifid.exe) and allows remote authenticated users to create or overwrite arbitrary files via crafted log pathnames. I...

CVE-2012-5932

CVE-2012-5932 describes an eval-injection in the ldapagnt_eval function of NetIQ Privileged User Manager (unifid.exe, ldapagnt.dll) affecting 2.3.x up to before 2.3.1 HF2. A crafted application/x-amf request can trigger remote code execution (Perl) with SYSTEM privileges, as reported by multiple ...

PT-2012-6204

Name of the Vulnerable Software and Affected Versions NetIQ Privileged User Manager versions 2.3.x through 2.3.1 before HF2 Description The issue allows remote attackers to execute arbitrary Perl code via a crafted application/x-amf request. This is due to an eval injection vulnerability in the...