Suse Lifecycle Management Server (Novell) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2014-04-16. Vendor: Novell.

CVEs of Suse Lifecycle Management Server

• CVE-2011-0993 - CVSS 2.1 (low), 2014-04-16: SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified…
• CVE-2013-3709 - CVSS 7.2 (high), 2013-12-23: WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from…
• CVE-2013-3710 - CVSS 4.3 (medium), 2013-12-10: SUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat…
• CVE-2013-7042 - CVSS 4.6 (medium), 2013-12-10: SUSE Lifecycle Management Server (SLMS) before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via…
• CVE-2010-1325 - CVSS 4.3 (medium), 2010-09-03: Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11…