CVE-2017-15549

CVE-2017-15549 describes an arbitrary file upload vulnerability. A remote authenticated malicious user with low privileges could upload arbitrary files to any location on the server filesystem in affected VMware vSphere Data Protection (VDP) deployments, including VDP 5.x, 6.0.x, and 6.1.x. Affec...

CVE-2017-15550

CVE-2017-15550 is a path-traversal vulnerability in VMware vSphere Data Protection (VDP). A remote authenticated malicious user with low privileges could access arbitrary files on the server filesystem within the vulnerable VDP application. Affected product versions include VDP 5.x, 6.0.x, and 6....

CVE-2017-15548

CVE-2017-15548 affects EMC/VDP solutions: vSphere Data Protection (VDP) on VMware appliances 5.x, 6.0.x, 6.1.x with an authentication bypass vulnerability that could allow a remote unauthenticated attacker to gain unauthorized root access. Related issues CVE-2017-15549 (arbitrary file upload) and...

PT-2018-5915

Name of the Vulnerable Software and Affected Versions: EMC Avamar Server versions 7.1.x through 7.5.0 EMC NetWorker Virtual Edition NVE versions 9.0.x through 9.2.x EMC Integrated Data Protection Appliance version 2.0 Description: A remote authenticated malicious user with low privileges could...

CVE-2017-15549: Unrestricted Upload of File with Dangerous Type

An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition NVE 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could potentially upload arbitrary maliciously crafted...

CVE-2017-15548: Improper Authentication

An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition NVE 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote unauthenticated malicious user can potentially bypass application authentication and gain unauthorized...

PT-2018-5916

Name of the Vulnerable Software and Affected Versions: EMC Avamar Server versions 7.1.x through 7.5.0 EMC NetWorker Virtual Edition NVE versions 9.0.x through 9.2.x EMC Integrated Data Protection Appliance version 2.0 Description: A remote authenticated malicious user with low privileges could...

CVE-2017-15550: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition NVE 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could access arbitrary files on the server file system...

Cross site scripting

In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could...

CVE-2017-14383

In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could...

CVE-2017-14383

In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could...

CVE-2017-14383

In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could...

CVE-2017-14383

CVE-2017-14383 affects Dell EMC VNX2 (Operating Environment for File) versions prior to 8.1.9.217 and Dell EMC VNX1 versions prior to 7.1.80.8, where the web server error page in the VNX Control Station is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote, unauthentica...

CVE-2017-14383: Improper Neutralization of Input During Web Page Generation

In Dell EMC VNX2 versions prior to Operating Environment for File 8.1.9.217 and VNX1 versions prior to Operating Environment for File 7.1.80.8, a web server error page in VNX Control Station is impacted by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could...

PT-2018-5628

Name of the Vulnerable Software and Affected Versions: Dell EMC VNX2 versions prior to 8.1.9.217 Dell EMC VNX1 versions prior to 7.1.80.8 Description: A reflected cross-site scripting issue affects the web server error page in VNX Control Station. This could allow a remote unauthenticated attacke...

EMC xPression 4.5SP1 Patch 13 SQL Injection Vulnerability

Exploit for multiple platform in category web applications Title: EMC xDashboard - SQL Injection Vulnerability Author: Pawel Gocyla Date: 02 January 2018 CVE: CVE-2017-14960 Affected Software: ================== EMC xPression v4.5SP1 Patch 13 Probably other versions are also vulnerable. SQL...

EMC xPression 4.5SP1 Patch 13 - model.jobHistoryId SQL Injection

EMC xPression 4.5SP1 Patch 13 - model.jobHistoryId SQL Injection Title: EMC xDashboard - SQL Injection Vulnerability Author: Pawel Gocyla Date: 02 January 2018 CVE: CVE-2017-14960 Affected Software: ================== EMC xPression v4.5SP1 Patch 13 Probably other versions are also vulnerable. SQL...

EMC xPression 4.5SP1 Patch 13 SQL Injection

Title: EMC xDashboard - SQL Injection Vulnerability Author: Pawel Gocyla Date: 02 January 2018 CVE: CVE-2017-14960 Affected Software: ================== EMC xPression v4.5SP1 Patch 13 Probably other versions are also vulnerable. SQL Injection Vulnerability: ============================== This...

PT-2018-1031

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions 7.1.x through 7.5.0 EMC NetWorker Virtual Edition NVE versions 9.0.x through 9.2.x EMC Integrated Data Protection Appliance version 2.0 Description The issue is related to weaknesses in the authentication procedure o...

EMC xPression 4.5SP1 Patch 13 - 'model.jobHistoryId' SQL Injection

Title: EMC xDashboard - SQL Injection Vulnerability Author: Pawel Gocyla Date: 02 January 2018 CVE: CVE-2017-14960 Affected Software: ================== EMC xPression v4.5SP1 Patch 13 Probably other versions are also vulnerable. SQL Injection Vulnerability: ============================== This...