Code injection

Avamar Data Store ADS and Avamar Virtual Edition AVE in EMC Avamar Server before 7.3.0-233 use weak permissions for unspecified directories, which allows local users to obtain root access by replacing a script with a Trojan horse program...

CVE-2016-0917

The SMB service in EMC VNXe VNXe3200 Operating Environment prior to 3.1.5.8711957 and VNXe3100/3150/3300 Operating Environment prior to 2.4.4.22638, VNX1 File OE before 7.1.80.3, VNX2 File OE before 8.1.9.155, and Celerra all supported versions does not prevent duplicate NTLM challenge-response...

CVE-2016-0904

Avamar Data Store ADS and Avamar Virtual Edition AVE in EMC Avamar Server before 7.3.0-233 use the same encryption key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms and obtain sensitive client-server traffic information by...

CVE-2016-0917

The CVE-2016-0917 entry concerns EMC SMB services in VNXe (VNXe3200 OE <3.1.5.8711957 and VNXe3100/3150/3300 OE <2.4.4.22638), VNX1 File OE <7.1.80.3, VNX2 File OE

CVE-2016-0925

The CVE-2016-0925 entry describes a cross-site scripting (XSS) vulnerability in the Case Management component of EMC RSA Adaptive Authentication (On-Premise). Affected versions include 6.0.2.1.SP3.P4 HF210; 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50; and 7.2.x before 7.2.0.0.SP0.P0 HF20. The issu...

CVE-2016-0905

CVE-2016-0905 affects EMC Avamar Server components Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) prior to version 7.3.0-233. The issue allows a local attacker with admin access to obtain root privileges by entering a sudo command; remediation is to upgrade to 7.3.0-233 or later. The co...

CVE-2016-0921

EMC Avamar Server components Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) are affected by a local privilege escalation due to weak permissions on unspecified directories. The underlying issue is weak directory permissions that allow a local user to replace a script with a Trojan horse...

CVE-2016-0904

The CVE-2016-0904 entry covers EMC Avamar Server components: Avamar Data Store (ADS) and Avamar Virtual Edition (AVE). The root cause is that ADS/AVE installations use the same encryption key across different customers, enabling a remote attacker to defeat cryptographic protections and glean sens...

CVE-2016-0920

EMC Avamar Server (including Avamar Data Store ADS and Avamar Virtual Edition AVE) is affected by CVE-2016-0920 in versions before 7.3.0-233. A local attacker can obtain root privileges by passing a crafted parameter to a command that is present in the sudo configuration. The issue is locally exp...

CVE-2016-0903

Avamar Data Store ADS and Avamar Virtual Edition AVE in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attackers to spoof clients and read backup data via a modified client agent...

CVE-2016-0905

Avamar Data Store ADS and Avamar Virtual Edition AVE in EMC Avamar Server before 7.3.0-233 allow local users to obtain root privileges by leveraging admin access and entering a sudo command...

CVE-2016-0925

Cross-site scripting XSS vulnerability in the Case Management application in EMC RSA Adaptive Authentication On-Premise before 6.0.2.1.SP3.P4 HF210, 7.0.x and 7.1.x before 7.1.0.0.SP0.P6 HF50, and 7.2.x before 7.2.0.0.SP0.P0 HF20 allows remote authenticated users to inject arbitrary web script or...

CVE-2016-0920: Improper Neutralization of Special Elements used in a Command

Avamar Data Store ADS and Avamar Virtual Edition AVE in EMC Avamar Server before 7.3.0-233 allow local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration...

PT-2016-4478

Name of the Vulnerable Software and Affected Versions EMC RSA Adaptive Authentication On-Premise versions prior to 6.0.2.1.SP3.P4 HF210 EMC RSA Adaptive Authentication On-Premise versions 7.0.x through 7.1.x before 7.1.0.0.SP0.P6 HF50 EMC RSA Adaptive Authentication On-Premise versions 7.2.x befo...

PT-2016-4471

Name of the Vulnerable Software and Affected Versions EMC VNXe3200 Operating Environment versions prior to 3.1.5.8711957 EMC VNXe3100/3150/3300 Operating Environment versions prior to 2.4.4.22638 VNX1 File OE versions prior to 7.1.80.3 VNX2 File OE versions prior to 8.1.9.155 Celerra all supporte...

PT-2016-4474

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233 Description The issue concerns weak permissions for unspecified directories in Avamar Data Store ADS and Avamar Virtual Edition AVE, allowing local users to gain root access. This can be achieved b...

PT-2016-4457

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233 Description The issue allows remote attackers to spoof clients and read backup data by modifying the client agent, due to the reliance on client-side authentication. Recommendations For versions...

PT-2016-4473

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233 Description The issue allows local users to obtain root access via a crafted parameter to a command that is available in the sudo configuration. This is related to Avamar Data Store ADS and Avamar...

PT-2016-4459

Name of the Vulnerable Software and Affected Versions EMC Avamar Server versions prior to 7.3.0-233 Description The issue allows local users to obtain root privileges by leveraging admin access and entering a sudo command. This can be exploited by users with admin access to gain elevated...

CVE-2016-0903: Exposure of Sensitive Information to an Unauthorized Actor

Avamar Data Store ADS and Avamar Virtual Edition AVE in EMC Avamar Server before 7.3.0-233 rely on client-side authentication, which allows remote attackers to spoof clients and read backup data via a modified client agent...