CVE-2016-9168

A missing X-Frame-Options header in the NDS Utility Monitor in NDSD in Novell eDirectory before 9.0.2 could be used by remote attackers for clickjacking...

CVE-2016-5747

A security vulnerability in cookie handling in the http stack implementation in NDSD in Novell eDirectory before 9.0.1 allows remote attackers to bypass intended access restrictions by leveraging predictable cookies...

CVE-2016-9168

CVE-2016-9168 affects Novell eDirectory’s NDSD (NDS Utility Monitor) prior to version 9.0.2, where a missing X-Frame-Options header could enable clickjacking by remote attackers. The vulnerability is documented across multiple feeds (NVD entry and cross-references in CNVD/OpenVAS records) and is ...

CVE-2016-5747

The CVE-2016-5747 entry concerns Novell eDirectory’s NDSD HTTP stack cookie handling, where predictable cookies enable remote bypass of access restrictions prior to version 9.0.1. Multiple sources (NVD, CNVD, OpenVAS) confirm the vulnerability in the cookie-based auth flow, affecting eDirectory b...

CVE-2016-9167

Affected product: Novell eDirectory NDSD prior to 9.0.2. The issue is that ACLs on LDAP objects across partition boundaries are not calculated correctly, enabling privilege escalation by modifying user attributes that would otherwise be filtered by an ACL. Root cause: incorrect ACL evaluation acr...

[CORE-2015-0006] - Fortinet Single Sign On Stack Overflow

Advisory Information Title: Fortinet Single Sign On Stack Overflow Advisory ID: CORE-2015-0006 Advisory URL: http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow Date published: 2015-03-18 Date of last update: 2015-03-18 Vendors contacted: Fortinet Release mode:...

Fortinet Single Sign On - Stack Overflow

Fortinet Single Sign On - Stack Overflow 1. Advisory Information Title: Fortinet Single Sign On Stack Overflow Advisory ID: CORE-2015-0006 Advisory URL: http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow Date published: 2015-03-18 Date of last update: 2015-03-18 Vendors...

Novell eDirectory iMonitor Multiple Vulnerabilities (Feb 2015)

Novell eDirectory is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:netiq:edirectory";...

Novell eDirectory IMONITOR Cross-Site Scripting (CVE-2014-5212)

A cross-site scripting vulnerability exists in Novell eDirectory IMONITOR. The vulnerability is due to an input validation error while parsing the rdn parameter. A remote attacker could exploit this vulnerability to execute arbitrary script or HTML code in the user's browser session...

Novell eDirectory evtFilteredMonitorEventsRequest Invalid free Code Execution - Ver2 (CVE-2006-4510)

A code execution vulnerability has been reported in Novell eDirectory. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

SEC Consult SA-20141219-0 :: XSS & Memory Disclosure vulnerabilities in NetIQ eDirectory NDS iMonitor

SEC Consult Vulnerability Lab Security Advisory 20141219-0 ======================================================================= title: XSS & Memory Disclosure product: NetIQ eDirectory NDS iMonitor vulnerable version: 8.8 SP8, 8.8 SP7 fixed version: 8.8 SP8 HF 4, fix available for versions 8.8...

NetIQ eDirectory NDS iMonitor security vulnerabilities

Crossite scripting, information leakage...

NetIQ eDirectory NDS iMonitor 8.8 SP8 / 8.8 SP7 XSS / Memory Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: XSS & Memory Disclosure product: NetIQ eDirectory NDS iMonitor vulnerable version: 8.8 SP8, 8.8 SP7 fixed version: 8.8 SP8 HF 4, fix available for versions 8.8 SP7 8.8.7....

CVE-2014-5213

nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authenticated users to obtain sensitive information from process memory via a direct request...

Cross site scripting

Cross-site scripting XSS vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers to inject arbitrary web script or HTML via the rdn parameter...

CVE-2014-5212

Cross-site scripting XSS vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers to inject arbitrary web script or HTML via the rdn parameter...

Server side request forgery (ssrf)

nds/files/opt/novell/eDirectory/lib64/ndsimon/public/images in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote authenticated users to obtain sensitive information from process memory via a direct request...

EUVD-2014-5110

Cross-site scripting XSS vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers to inject arbitrary web script or HTML via the rdn parameter...

CVE-2014-5213

CVE-2014-5213 affects NetIQ eDirectory NDS iMonitor in the 8.8 SP7/SP8 line. The vulnerability is a memory-disclosure issue: an authenticated administrator or user can request memory content from the iMonitor service, potentially leaking sensitive data. Exploitation required an authenticated sess...

CVE-2014-5212

Cross-site scripting XSS vulnerability in nds/search/data in iMonitor in Novell eDirectory before 8.8 SP8 Patch 4 allows remote attackers to inject arbitrary web script or HTML via the rdn parameter...