Novell Filr vulnerabilities

CVE-2016-1608 [HIGH] CWE-284 CVE-2016-1608: vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows re vaconfig/time in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ntpServer parameter.

CVE-2016-1610 [HIGH] CWE-22 CVE-2016-1610: Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security U Directory traversal vulnerability in the email-template feature in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allows remote attackers to bypass intended access restrictions and write to arbitrary files via a .. (dot dot) in a blob name.

CVE-2016-1611 [HIGH] CWE-264 CVE-2016-1611: Novell Filr 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 uses world-writable permissions for /e Novell Filr 1.2 before Hot Patch 6 and 2.0 before Hot Patch 2 uses world-writable permissions for /etc/profile.d/vainit.sh, which allows local users to gain privileges by replacing this file's content with arbitrary shell commands.

CVE-2016-1607 [HIGH] CWE-352 CVE-2016-1607: Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Novell Multiple cross-site request forgery (CSRF) vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request.

CVE-2016-1609 [MEDIUM] CWE-79 CVE-2016-1609: Multiple cross-site scripting (XSS) vulnerabilities in Novell Filr before 1.2 Security Update 3 and Multiple cross-site scripting (XSS) vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input, as demonstrated by a crafted attribute of an IMG element in the phone field of a user profile.

CVE-2015-5968 [MEDIUM] CWE-79 CVE-2015-5968: Cross-site scripting (XSS) vulnerability in Novell Filr 1.2 before Hot Patch 4 allows remote attacke Cross-site scripting (XSS) vulnerability in Novell Filr 1.2 before Hot Patch 4 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.