CVE-2016-1595
N/A
N/A
Summary
LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to conduct Hibernate Query Language (HQL) injection attacks and obtain sensitive information via the entityName parameter.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | n/a | n/a | affected |
Weaknesses
- n/a
ADP Enrichment
CVE Program Container
Additional References
- https://www.novell.com/support/kb/doc.php?id=7017430
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt
- https://packetstormsecurity.com/files/136646
- http://www.securityfocus.com/archive/1/538043/100/0/threaded
- https://www.exploit-db.com/exploits/39687/
References
- https://www.novell.com/support/kb/doc.php?id=7017430
- https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt
- https://packetstormsecurity.com/files/136646
- http://www.securityfocus.com/archive/1/538043/100/0/threaded
- https://www.exploit-db.com/exploits/39687/
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.