CVE-2016-0904: Exposure of Sensitive Information to an Unauthorized Actor

Avamar Data Store ADS and Avamar Virtual Edition AVE in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by...

CVE-2016-0903: Exposure of Sensitive Information to an Unauthorized Actor

Avamar Data Store ADS and Avamar Virtual Edition AVE in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attackers to spoof clients and read backup data via a modified client agent...

CVE-2016-0921: Undefined Security Weakness

Avamar Data Store ADS and Avamar Virtual Edition AVE in EMC Avamar Server before 7.3.0-233 use weak permissions for unspecified directories, which allows local users to obtain root access by replacing a script with a Trojan horse program...

PT-2016-4458

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233 Description The issue allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by leveraging knowledge of the encryption key used...

PT-2016-4457

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233 Description The issue allows remote attackers to spoof clients and read backup data by modifying the client agent, due to the reliance on client-side authentication. Recommendations For versions...

PT-2016-4473

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233 Description The issue allows local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration. This is related to Avamar Data Store ADS and Avamar...

PT-2016-4459

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233 Description The issue allows local users to obtain root privileges by leveraging admin access and entering a sudo command. This can be exploited by users with admin access to gain elevated...

PT-2016-4474

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233 Description The issue concerns weak permissions for unspecified directories in Avamar Data Store ADS and Avamar Virtual Edition AVE, allowing local users to gain root access. This can be achieved b...

EMC Avamar Virtual Edition and EMC Avamar Server Directory Traversal Vulnerability

EMC Avamar Virtual Edition is a fully virtualized backup and recovery solution of which EMC Avamar Server is the server-side software. A directory traversal vulnerability exists in EMC Avamar Virtual Edition and EMC Avamar Server, which allows remote attackers to exploit the vulnerability by...

CVE-2015-4527

Directory traversal vulnerability in EMC Avamar Server 7.x before 7.1.2 and Avamar Virtual Addition AVE 7.x before 7.1.2 allows remote attackers to read arbitrary files by using the Avamar Desktop/Laptop client interface to send crafted parameters...

Directory traversal

Directory traversal vulnerability in EMC Avamar Server 7.x before 7.1.2 and Avamar Virtual Addition AVE 7.x before 7.1.2 allows remote attackers to read arbitrary files by using the Avamar Desktop/Laptop client interface to send crafted parameters...

CVE-2015-4527

EMC Avamar Server (7.x, prior to 7.1.2) and Avamar Virtual Edition (AVE) (7.x, prior to 7.1.2) are affected by a directory traversal flaw. The vulnerability allows remote attackers to read arbitrary files by sending crafted parameters via the Avamar Desktop/Laptop client interface. Root cause is ...

CVE-2015-4527

Directory traversal vulnerability in EMC Avamar Server 7.x before 7.1.2 and Avamar Virtual Addition AVE 7.x before 7.1.2 allows remote attackers to read arbitrary files by using the Avamar Desktop/Laptop client interface to send crafted parameters...

PT-2015-6607

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions 7.0 through 7.1.2 EMC Avamar Virtual Addition AVE versions 7.0 through 7.1.2 Description A directory traversal issue allows remote attackers to read arbitrary files by sending crafted parameters through the Avamar...

CVE-2015-4527: Exposure of Sensitive Information to an Unauthorized Actor

Directory traversal vulnerability in EMC Avamar Server 7.x before 7.1.2 and Avamar Virtual Addition AVE 7.x before 7.1.2 allows remote attackers to read arbitrary files by using the Avamar Desktop/Laptop client interface to send crafted parameters...

CVE-2013-3275

EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly restrict use of FRAME elements, which makes it easier for remote attackers to obtain sensitive information via a crafted web site, related to "cross frame scripting vulnerabilitie...

ESA-2013-055: EMC Avamar Multiple Vulnerabilities

ESA-2013-055.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-055: EMC Avamar Multiple Vulnerabilities EMC Identifier: ESA-2013-055 CVE Identifier: CVE-2013-3274, CVE-2013-3275 Severity Rating: See below for individual scores Affected products: All EMC Avamar Server and Avamar Virtual...

CVE-2013-3274

EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly determine authorization for calls to Java RMI methods, which allows remote authenticated users to execute arbitrary code via unspecified vectors...

CVE-2013-3275

EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly restrict use of FRAME elements, which makes it easier for remote attackers to obtain sensitive information via a crafted web site, related to "cross frame scripting vulnerabilitie...

PT-2013-4271

Name of the Vulnerable Software and Affected Versions EMC Avamar Server and Avamar Virtual Edition versions prior to 7.0 Description The issue makes it easier for remote attackers to obtain sensitive information via a crafted web site, related to cross frame scripting vulnerabilities, due to the...