CVE-2017-2766

EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified password change vulnerability that could potentially be exploited by malicious users to compromise th...

CVE-2016-8211

EMC Data Protection Advisor (DPA) is affected by a path traversal vulnerability (CVE-2016-8211) in the ImageServlet component. The issue exists on DPA installations listening on ports 9002 and 9004, caused by improper validation of a user-supplied path before file operations, enabling an unauthen...

CVE-2017-2766

CVE-2017-2766 affects EMC Documentum eRoom: vulnerable in versions 7.4.4, 7.4.4 SP1, and prior to 7.4.5 P04 or 7.5.0 P01 due to an unverified password change vulnerability. This could allow a malicious user to compromise the affected system. According to the sources, the issue manifests in the pa...

CVE-2017-2767

EMC Network Configuration Manager NCM 9.3.x, EMC Network Configuration Manager NCM 9.4.0.x, EMC Network Configuration Manager NCM 9.4.1.x, EMC Network Configuration Manager NCM 9.4.2.x contains a Java RMI Remote Code Execution vulnerability that could potentially be exploited by malicious users t...

CVE-2016-0890

CVE-2016-0890 affects EMC PowerPath Virtual (Management) Appliance 2.0 and 2.0 SP1, describing a sensitive information disclosure vulnerability that could allow malicious users to obtain sensitive information. The Connected documents provide high-level descriptions of the defect but do not includ...

CVE-2016-0919

CVE-2016-0919 concerns a cross-site scripting vulnerability in EMC RSA Web Threat Detection, affecting versions 5.0, 5.1, and 5.1.2. The connected sources consistently state that the issue is a cross-site scripting flaw that could allow a malicious actor to compromise the affected system; however...

CVE-2016-0919

EMC RSA Web Threat Detection version 5.0, RSA Web Threat Detection version 5.1, RSA Web Threat Detection version 5.1.2 has a cross site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2016-0919: Improper Neutralization of Input During Web Page Generation

EMC RSA Web Threat Detection version 5.0, RSA Web Threat Detection version 5.1, RSA Web Threat Detection version 5.1.2 has a cross site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system...

PT-2017-9535

Name of the Vulnerable Software and Affected Versions EMC Data Domain OS DD OS versions 5.4 EMC Data Domain OS DD OS 5.5 family versions prior to 5.5.5.0 EMC Data Domain OS DD OS 5.6 family versions prior to 5.6.2.0 EMC Data Domain OS DD OS 5.7 family versions prior to 5.7.2.10 Description The...

PT-2017-10372

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 4.5 through 4.6 Description The issue allows an authenticated low-privileged attacker to potentially exploit it and access information, modify data, or disrupt services by causing execution of arbitrary DQL commands ...

PT-2017-9536

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE Crypto-J versions prior to 6.2.2 Description The issue allows for a possible timing attack by modifying a PKCS12 file with an unknown password, enabling an attacker to guess the current MAC one byte at a time. This is due to the...

CVE-2016-8216: Undefined Security Weakness

EMC Data Domain OS DD OS 5.4 all versions, EMC Data Domain OS DD OS 5.5 family all versions prior to 5.5.5.0, EMC Data Domain OS DD OS 5.6 family all versions prior to 5.6.2.0, EMC Data Domain OS DD OS 5.7 family all versions prior to 5.7.2.10 has a command injection vulnerability that could...

CVE-2016-8212: Improper Resource Shutdown or Release

An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpda...

CVE-2016-0890: Exposure of Sensitive Information to an Unauthorized Actor

EMC PowerPath Virtual Management Appliance 2.0, EMC PowerPath Virtual Management Appliance 2.0 SP1 is affected by a sensitive information disclosure vulnerability that may potentially be exploited by malicious users to compromise the affected system...

CVE-2017-2768: Improper Authentication

EMC Network Configuration Manager NCM 9.3.x, EMC Network Configuration Manager NCM 9.4.0.x, EMC Network Configuration Manager NCM 9.4.1.x, EMC Network Configuration Manager NCM 9.4.2.x contains an Improper Authentication vulnerability that could potentially be exploited by malicious users to...

CVE-2017-2766: Weak Password Recovery Mechanism for Forgotten Password

EMC Documentum eRoom version 7.4.4, EMC Documentum eRoom version 7.4.4 SP1, EMC Documentum eRoom version prior to 7.4.5 P04, EMC Documentum eRoom version prior to 7.5.0 P01 includes an unverified password change vulnerability that could potentially be exploited by malicious users to compromise th...

PT-2017-9531

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE Crypto-J versions prior to 6.2.2 Description The issue is related to an improper OCSP validation. OCSP responses contain two time values: thisUpdate and nextUpdate, which specify a validity period. However, both values are...

CVE-2016-9872: Improper Neutralization of Input During Web Page Generation

EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has Reflected Cross-Site Scripting Vulnerabilities that could potentially be exploited by malicious users to compromise the affected system...

PT-2017-10371

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 4.5 through 4.6 Description The issue is related to Reflected Cross-Site Scripting, which could potentially be exploited by malicious users to compromise the affected system. Recommendations For EMC Documentum D2...

CVE-2016-9873: Improper Neutralization of Special Elements used in a Command

EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to compromise the affected system. An authenticated low-privileged attacker could potentially exploit this vulnerability to access information,...