Vulnerability-Lookup - Search a vulnerability

CVE-2013-3709 (GCVE-0-2013-3709)

Vulnerability from cvelistv5

Published

2013-12-23 23:00

Modified

2024-08-06 16:14

Severity ?

Summary

WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.

References

▼	URL	Tags
	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00014.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html	vendor-advisory, x_refsource_SUSE
	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.novell.com/show_bug.cgi?id=851116	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T16:14:56.756Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "openSUSE-SU-2013:1961",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00014.html",
               },
               {
                  name: "SUSE-SU-2014:0022",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00001.html",
               },
               {
                  name: "openSUSE-SU-2013:1952",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html",
               },
               {
                  name: "openSUSE-SU-2013:1954",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb",
               },
               {
                  name: "SUSE-SU-2013:1894",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.novell.com/show_bug.cgi?id=851116",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2013-12-16T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2014-01-07T13:57:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "openSUSE-SU-2013:1961",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00014.html",
            },
            {
               name: "SUSE-SU-2014:0022",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00001.html",
            },
            {
               name: "openSUSE-SU-2013:1952",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html",
            },
            {
               name: "openSUSE-SU-2013:1954",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb",
            },
            {
               name: "SUSE-SU-2013:1894",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.novell.com/show_bug.cgi?id=851116",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2013-3709",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "openSUSE-SU-2013:1961",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00014.html",
                  },
                  {
                     name: "SUSE-SU-2014:0022",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00001.html",
                  },
                  {
                     name: "openSUSE-SU-2013:1952",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html",
                  },
                  {
                     name: "openSUSE-SU-2013:1954",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html",
                  },
                  {
                     name: "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb",
                     refsource: "MISC",
                     url: "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb",
                  },
                  {
                     name: "SUSE-SU-2013:1894",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html",
                  },
                  {
                     name: "https://bugzilla.novell.com/show_bug.cgi?id=851116",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.novell.com/show_bug.cgi?id=851116",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2013-3709",
      datePublished: "2013-12-23T23:00:00",
      dateReserved: "2013-05-30T00:00:00",
      dateUpdated: "2024-08-06T16:14:56.756Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2010-1325 (GCVE-0-2010-1325)

Vulnerability from cvelistv5

Published

2010-09-03 19:00

Modified

2024-08-07 01:21

Severity ?

Summary

Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting. NOTE: some sources report that this is a vulnerability in a product named "Apache SLMS," but that is incorrect.

References

▼	URL	Tags
	https://bugzilla.novell.com/show_bug.cgi?id=588284	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/42121	vdb-entry, x_refsource_BID
	http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://support.novell.com/security/cve/CVE-2010-1325.html	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/61006	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-07T01:21:18.670Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.novell.com/show_bug.cgi?id=588284",
               },
               {
                  name: "42121",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/42121",
               },
               {
                  name: "SUSE-SR:2010:014",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://support.novell.com/security/cve/CVE-2010-1325.html",
               },
               {
                  name: "apacheslms-quoting-csrf(61006)",
                  tags: [
                     "vdb-entry",
                     "x_refsource_XF",
                     "x_transferred",
                  ],
                  url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/61006",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2010-08-02T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting.  NOTE: some sources report that this is a vulnerability in a product named \"Apache SLMS,\" but that is incorrect.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-08-16T14:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.novell.com/show_bug.cgi?id=588284",
            },
            {
               name: "42121",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/42121",
            },
            {
               name: "SUSE-SR:2010:014",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://support.novell.com/security/cve/CVE-2010-1325.html",
            },
            {
               name: "apacheslms-quoting-csrf(61006)",
               tags: [
                  "vdb-entry",
                  "x_refsource_XF",
               ],
               url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/61006",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2010-1325",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting.  NOTE: some sources report that this is a vulnerability in a product named \"Apache SLMS,\" but that is incorrect.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.novell.com/show_bug.cgi?id=588284",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.novell.com/show_bug.cgi?id=588284",
                  },
                  {
                     name: "42121",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/42121",
                  },
                  {
                     name: "SUSE-SR:2010:014",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
                  },
                  {
                     name: "http://support.novell.com/security/cve/CVE-2010-1325.html",
                     refsource: "CONFIRM",
                     url: "http://support.novell.com/security/cve/CVE-2010-1325.html",
                  },
                  {
                     name: "apacheslms-quoting-csrf(61006)",
                     refsource: "XF",
                     url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/61006",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2010-1325",
      datePublished: "2010-09-03T19:00:00",
      dateReserved: "2010-04-08T00:00:00",
      dateUpdated: "2024-08-07T01:21:18.670Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2013-7042 (GCVE-0-2013-7042)

Vulnerability from cvelistv5

Published

2013-12-10 15:00

Modified

2024-08-06 17:53

Severity ?

Summary

SUSE Lifecycle Management Server (SLMS) before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via unspecified vectors.

References

▼	URL	Tags
	https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.novell.com/show_bug.cgi?id=852101	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/89897	vdb-entry, x_refsource_XF
	http://osvdb.org/100652	vdb-entry, x_refsource_OSVDB

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T17:53:45.936Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "SUSE-SU-2013:1813",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
               },
               {
                  name: "slms-cve20137042-information-disclosure(89897)",
                  tags: [
                     "vdb-entry",
                     "x_refsource_XF",
                     "x_transferred",
                  ],
                  url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/89897",
               },
               {
                  name: "100652",
                  tags: [
                     "vdb-entry",
                     "x_refsource_OSVDB",
                     "x_transferred",
                  ],
                  url: "http://osvdb.org/100652",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2013-11-25T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "SUSE Lifecycle Management Server (SLMS) before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-08-28T12:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "SUSE-SU-2013:1813",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
            },
            {
               name: "slms-cve20137042-information-disclosure(89897)",
               tags: [
                  "vdb-entry",
                  "x_refsource_XF",
               ],
               url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/89897",
            },
            {
               name: "100652",
               tags: [
                  "vdb-entry",
                  "x_refsource_OSVDB",
               ],
               url: "http://osvdb.org/100652",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2013-7042",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "SUSE Lifecycle Management Server (SLMS) before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "SUSE-SU-2013:1813",
                     refsource: "SUSE",
                     url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
                  },
                  {
                     name: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
                  },
                  {
                     name: "slms-cve20137042-information-disclosure(89897)",
                     refsource: "XF",
                     url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/89897",
                  },
                  {
                     name: "100652",
                     refsource: "OSVDB",
                     url: "http://osvdb.org/100652",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2013-7042",
      datePublished: "2013-12-10T15:00:00",
      dateReserved: "2013-12-10T00:00:00",
      dateUpdated: "2024-08-06T17:53:45.936Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2013-3710 (GCVE-0-2013-3710)

Vulnerability from cvelistv5

Published

2013-12-10 15:00

Modified

2024-08-06 16:14

Severity ?

Summary

SUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.

References

▼	URL	Tags
	https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.novell.com/show_bug.cgi?id=852101	x_refsource_CONFIRM
	http://osvdb.org/100653	vdb-entry, x_refsource_OSVDB

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T16:14:56.772Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "SUSE-SU-2013:1813",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
               },
               {
                  name: "100653",
                  tags: [
                     "vdb-entry",
                     "x_refsource_OSVDB",
                     "x_transferred",
                  ],
                  url: "http://osvdb.org/100653",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2013-11-25T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "SUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2013-12-10T14:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "SUSE-SU-2013:1813",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
            },
            {
               name: "100653",
               tags: [
                  "vdb-entry",
                  "x_refsource_OSVDB",
               ],
               url: "http://osvdb.org/100653",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2013-3710",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "SUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "SUSE-SU-2013:1813",
                     refsource: "SUSE",
                     url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
                  },
                  {
                     name: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
                  },
                  {
                     name: "100653",
                     refsource: "OSVDB",
                     url: "http://osvdb.org/100653",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2013-3710",
      datePublished: "2013-12-10T15:00:00",
      dateReserved: "2013-05-30T00:00:00",
      dateUpdated: "2024-08-06T16:14:56.772Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2011-0993 (GCVE-0-2011-0993)

Vulnerability from cvelistv5

Published

2014-04-16 18:00

Modified

2024-08-06 22:14

Severity ?

Summary

SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

References

▼	URL	Tags
	https://exchange.xforce.ibmcloud.com/vulnerabilities/95697	vdb-entry, x_refsource_XF
	http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T22:14:26.837Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "slms-cve20110993-info-disc(95697)",
                  tags: [
                     "vdb-entry",
                     "x_refsource_XF",
                     "x_transferred",
                  ],
                  url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/95697",
               },
               {
                  name: "SUSE-SR:2011:007",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2011-04-19T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-08-16T14:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "slms-cve20110993-info-disc(95697)",
               tags: [
                  "vdb-entry",
                  "x_refsource_XF",
               ],
               url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/95697",
            },
            {
               name: "SUSE-SR:2011:007",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2011-0993",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "slms-cve20110993-info-disc(95697)",
                     refsource: "XF",
                     url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/95697",
                  },
                  {
                     name: "SUSE-SR:2011:007",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2011-0993",
      datePublished: "2014-04-16T18:00:00",
      dateReserved: "2011-02-14T00:00:00",
      dateUpdated: "2024-08-06T22:14:26.837Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Vulnerability from fkie_nvd

Published

2013-12-10 16:55

Modified

2025-04-11 00:51

Severity ?

Summary

SUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.

References

URL	Tags
cve@mitre.org	http://osvdb.org/100653
cve@mitre.org	https://bugzilla.novell.com/show_bug.cgi?id=852101
cve@mitre.org	https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/100653
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.novell.com/show_bug.cgi?id=852101
af854a3a-2127-422b-91ae-364da2661108	https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html	Vendor Advisory

Impacted products

Vendor	Product	Version
novell	suse_lifecycle_management_server	*
novell	suse_lifecycle_management_server	1.0
novell	suse_lifecycle_management_server	1.1
novell	suse_lifecycle_management_server	1.2

JSON

To clipboard

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7DD3103B-FCA8-469E-A89E-3CEB06463828",
                     versionEndIncluding: "1.3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "8CB693F6-A69D-4551-915D-063334219958",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "5F2A0B61-5099-4C89-8E5D-FC54B9353688",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:1.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "03A962C0-24E8-46EB-94D0-A3C62F282864",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "SUSE Lifecycle Management Server (SLMS) before 1.3.7 does not generate a new secret key when the service starts, which allows remote attackers to defeat intended cryptographic protection mechanisms by leveraging knowledge of this key from a product installation elsewhere.",
      },
      {
         lang: "es",
         value: "SUSE Lifecycle Management Server (SLMS) anteriores a 1.3.7 no genera una nueva clave secreta cuando el servicio arranca, lo que permite a atacantes remotos evadir mecanismos de proteccion criptográfica aprovechando el conocimiento de esta clave de una instalación del producto en cualquier otro lugar.",
      },
   ],
   id: "CVE-2013-3710",
   lastModified: "2025-04-11T00:51:21.963",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2013-12-10T16:55:25.447",
   references: [
      {
         source: "cve@mitre.org",
         url: "http://osvdb.org/100653",
      },
      {
         source: "cve@mitre.org",
         url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://osvdb.org/100653",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-310",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd

Published

2010-09-03 20:00

Modified

2025-04-11 00:51

Severity ?

Summary

Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting. NOTE: some sources report that this is a vulnerability in a product named "Apache SLMS," but that is incorrect.

References

▼	URL	Tags
	cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
	cve@mitre.org	http://support.novell.com/security/cve/CVE-2010-1325.html
	cve@mitre.org	http://www.securityfocus.com/bid/42121
	cve@mitre.org	https://bugzilla.novell.com/show_bug.cgi?id=588284
	cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/61006
	af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
	af854a3a-2127-422b-91ae-364da2661108	http://support.novell.com/security/cve/CVE-2010-1325.html
	af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/42121
	af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.novell.com/show_bug.cgi?id=588284
	af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/61006

Impacted products

	Vendor	Product	Version
	novell	suse_lifecycle_management_server	1.0
	novell	suse_linux	11

JSON

To clipboard

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "8CB693F6-A69D-4551-915D-063334219958",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:novell:suse_linux:11:-:enterprise:*:*:*:*:*",
                     matchCriteriaId: "BB545D91-1C4C-4692-B01A-B8DAE4A958BE",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site request forgery (CSRF) vulnerability in the apache2-slms package in SUSE Lifecycle Management Server (SLMS) 1.0 on SUSE Linux Enterprise (SLE) 11 allows remote attackers to hijack the authentication of unspecified victims via vectors related to improper parameter quoting.  NOTE: some sources report that this is a vulnerability in a product named \"Apache SLMS,\" but that is incorrect.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en apache2-slms package en SUSE Lifecycle Management Server (SLMS) v1.0 en SUSE Linux Enterprise (SLE) v11 permite a atacantes remotos secuestar la autenticación de víctimas no especificadas a través de vectores relacionados con parámetros citados inadecuados. NOSE: algunas fuentes reportan que esta vulnerabilidad en un producto llamado \"Apache SLMS,\" pero ésto es incorrecto.",
      },
   ],
   id: "CVE-2010-1325",
   lastModified: "2025-04-11T00:51:21.963",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
   },
   published: "2010-09-03T20:00:01.293",
   references: [
      {
         source: "cve@mitre.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://support.novell.com/security/cve/CVE-2010-1325.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://www.securityfocus.com/bid/42121",
      },
      {
         source: "cve@mitre.org",
         url: "https://bugzilla.novell.com/show_bug.cgi?id=588284",
      },
      {
         source: "cve@mitre.org",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/61006",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://support.novell.com/security/cve/CVE-2010-1325.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/42121",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://bugzilla.novell.com/show_bug.cgi?id=588284",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/61006",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-352",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd

Published

2013-12-23 23:55

Modified

2025-04-11 00:51

Severity ?

Summary

WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.

References

URL	Tags
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00014.html
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00001.html
cve@mitre.org	https://bugzilla.novell.com/show_bug.cgi?id=851116	Exploit
cve@mitre.org	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00014.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00001.html
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.novell.com/show_bug.cgi?id=851116	Exploit
af854a3a-2127-422b-91ae-364da2661108	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb

Impacted products

Vendor	Product	Version
novell	suse_lifecycle_management_server	1.3
suse	studio_onsite	1.3
suse	webyast	1.3

JSON

To clipboard

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:1.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "FD6001DB-C6AC-467F-8BDB-9FE8E59DAFB0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:suse:studio_onsite:1.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "74BCA435-7594-49E8-9BAE-9E02E129B6C0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:suse:webyast:1.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "EDC5169C-7B9A-4269-92F4-638374B79CD8",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "WebYaST 1.3 uses weak permissions for config/initializers/secret_token.rb, which allows local users to gain privileges by reading the Rails secret token from this file.",
      },
      {
         lang: "es",
         value: "WebYaST v1.3 usa permisos débiles en config/initializers/secret_token.rb, lo que permite a usuarios locales obtener privilegios mediante la lectura del token secreto de Rails de este archivo.",
      },
   ],
   id: "CVE-2013-3709",
   lastModified: "2025-04-11T00:51:21.963",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "COMPLETE",
               baseScore: 7.2,
               confidentialityImpact: "COMPLETE",
               integrityImpact: "COMPLETE",
               vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 10,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2013-12-23T23:55:04.093",
   references: [
      {
         source: "cve@mitre.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00014.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00001.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
         ],
         url: "https://bugzilla.novell.com/show_bug.cgi?id=851116",
      },
      {
         source: "cve@mitre.org",
         url: "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00006.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00012.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00013.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00014.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00001.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
         ],
         url: "https://bugzilla.novell.com/show_bug.cgi?id=851116",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/rails_secret_deserialization.rb",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-264",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd

Published

2014-04-16 18:37

Modified

2025-04-12 10:46

Severity ?

Summary

SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.

References

URL	Tags
cve@mitre.org	http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html	Vendor Advisory
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/95697
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/95697

Impacted products

	Vendor	Product	Version
	novell	suse_lifecycle_management_server	*

JSON

To clipboard

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7FEAC9D7-599B-4588-B12E-9B955A2081B5",
                     versionEndIncluding: "1.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "SUSE Lifecycle Management Server before 1.1 uses world readable postgres credentials, which allows local users to obtain sensitive information via unspecified vectors.",
      },
      {
         lang: "es",
         value: "SUSE Lifecycle Management Server anterior a 1.1 utiliza credenciales postgres leíbles por todos, lo que permite a usuarios locales obtener información sensible a través de vectores no especificados.",
      },
   ],
   id: "CVE-2011-0993",
   lastModified: "2025-04-12T10:46:40.837",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 2.1,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2014-04-16T18:37:09.130",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html",
      },
      {
         source: "cve@mitre.org",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/95697",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00005.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/95697",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-264",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd

Published

2013-12-10 16:55

Modified

2025-04-11 00:51

Severity ?

Summary

SUSE Lifecycle Management Server (SLMS) before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via unspecified vectors.

References

URL	Tags
cve@mitre.org	http://osvdb.org/100652
cve@mitre.org	https://bugzilla.novell.com/show_bug.cgi?id=852101
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/89897
cve@mitre.org	https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://osvdb.org/100652
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.novell.com/show_bug.cgi?id=852101
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/89897
af854a3a-2127-422b-91ae-364da2661108	https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html	Vendor Advisory

Impacted products

Vendor	Product	Version
novell	suse_lifecycle_management_server	*
novell	suse_lifecycle_management_server	1.0
novell	suse_lifecycle_management_server	1.1
novell	suse_lifecycle_management_server	1.2

JSON

To clipboard

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7DD3103B-FCA8-469E-A89E-3CEB06463828",
                     versionEndIncluding: "1.3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "8CB693F6-A69D-4551-915D-063334219958",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "5F2A0B61-5099-4C89-8E5D-FC54B9353688",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:novell:suse_lifecycle_management_server:1.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "03A962C0-24E8-46EB-94D0-A3C62F282864",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "SUSE Lifecycle Management Server (SLMS) before 1.3.7 uses world-readable permissions for the secret keys, which allows local users to gain privileges via unspecified vectors.",
      },
      {
         lang: "es",
         value: "SUSE Lifecycle Management Server (SLMS) anterior a la versión 1.3.7 utiliza permisos world-readable para claves secretas, lo que permite a usuarios locales obtener privilegios a través de vectores sin especificar.",
      },
   ],
   id: "CVE-2013-7042",
   lastModified: "2025-04-11T00:51:21.963",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 4.6,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:L/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2013-12-10T16:55:25.883",
   references: [
      {
         source: "cve@mitre.org",
         url: "http://osvdb.org/100652",
      },
      {
         source: "cve@mitre.org",
         url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
      },
      {
         source: "cve@mitre.org",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/89897",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://osvdb.org/100652",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://bugzilla.novell.com/show_bug.cgi?id=852101",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/89897",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.suse.com/support/update/announcement/2013/suse-su-20131813-1.html",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-264",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerabilites related to novell - suse_lifecycle_management_server

CVE-2013-3709 (GCVE-0-2013-3709)

Vulnerability from cvelistv5

CVE-2010-1325 (GCVE-0-2010-1325)

Vulnerability from cvelistv5

CVE-2013-7042 (GCVE-0-2013-7042)

Vulnerability from cvelistv5

CVE-2013-3710 (GCVE-0-2013-3710)

Vulnerability from cvelistv5

CVE-2011-0993 (GCVE-0-2011-0993)

Vulnerability from cvelistv5

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd

Vulnerability from fkie_nvd