Design/Logic Flaw

Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability...

Authentication flaw

NetIQ iManager 3.x before 3.0.3.1 has an issue in the renegotiation of connection parameters with Tomcat...

CVE-2017-7428

NetIQ iManager 3.x before 3.0.3.1 has an issue in the renegotiation of connection parameters with Tomcat...

CVE-2017-7431

Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management...

CVE-2017-7430

Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework...

CVE-2017-7430

Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework...

CVE-2017-7432

Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability...

CVE-2017-7431

Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have persistent CSRF in object management...

CVE-2017-7431

CVE-2017-7431 affects Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1, with a persistent CSRF flaw in object management. Root cause: CSRF in the management interface enabling unauthorized operations. Impact: potential unauthorized changes via authenticated ...

CVE-2017-7428

NetIQ iManager 3.x before 3.0.3.1 has an issue in the renegotiation of connection parameters with Tomcat...

CVE-2017-7428

NetIQ iManager 3.x before 3.0.3.1 contains a flaw in negotiating Tomcat connection parameters. The issue is described as a renegotiation problem during parameter exchange with Tomcat, affecting NetIQ iManager 3.x prior to 3.0.3.1. The CVSS data indicates an overall Medium impact with partial avai...

CVE-2017-7430

Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework...

CVE-2017-7430

The CVE-2017-7430 entry covers a persistent XSS vulnerability in the Framework of Novell iManager 2.7.x (before 2.7 SP7 Patch 10 HF1) and NetIQ iManager 3.x (before 3.0.3.1). Root cause: improper handling/injection point in the Framework that allows crafted input to be stored or repeatedly reflec...

CVE-2017-7432

CVE-2017-7432 affects Novell iManager 2.7.x prior to 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x prior to 3.0.3.1. The connected records confirm a webshell upload vulnerability in these versions. No explicit root cause, exploit details, or impact beyond webshell upload are provided in the documen...

CVE-2017-5186

CVE-2017-5186 affects Novell iManager and NetIQ eDirectory (versions listed in the CVE) and is due to the use of the deprecated MD5 hashing algorithm in a communications certificate. The connected SUSE entry reiterates the same affected products and patch level references. The provided sources do...

CVE-2016-5750

The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users...

CVE-2016-5757

iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to authentication credentials...

Design/Logic Flaw

iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to authentication credentials...

Design/Logic Flaw

The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users...

CVE-2016-5750

The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users...