ESA-2015-115: EMC RecoverPoint for Virtual Machines (VMs) Restriction Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-115: EMC RecoverPoint for Virtual Machines VMs Restriction Bypass Vulnerability EMC Identifier: ESA-2015-115 CVE Identifier: CVE-2015-4526 Severity Rating: CVSSv2 Base Score: 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Affected products: • EMC RecoverPoin...

Extra information for CVE-2014-2513 - EMC Documentum Content Server: arbitrary code execution

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed On November 2013 I discovered vulnerability in EMC Documentum Content Server which allow authenticated user to execute arbitrary commands using dmbptransition docbase method for detailed...

CVE-2015-4526

EMC RecoverPoint for Virtual Machines VMs 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface...

Design/Logic Flaw

EMC RecoverPoint for Virtual Machines VMs 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface...

CVE-2015-4526

EMC RecoverPoint for Virtual Machines VMs 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface...

CVE-2015-4526

EMC RecoverPoint for Virtual Machines (VMs) 4.2 is affected by a local privilege escalation where an attacker can bypass the Installation Manager Boxmgmt CLI interface to gain root-shell access. The issue is reported for version 4.2 and is described as a restriction bypass that enables command ex...

PT-2015-6606

Name of the Vulnerable Software and Affected Versions EMC RecoverPoint for Virtual Machines VMs version 4.2 Description The issue allows local users to bypass the Installation Manager Boxmgmt CLI interface, resulting in root-shell access. Recommendations For version 4.2, at the moment, there is n...

CVE-2015-4526: Improper Access Control

EMC RecoverPoint for Virtual Machines VMs 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface...

EMC Documentum Content Server CVE-2014-2513 Bad Fix

Product: EMC Documentum Content Server Vendor: EMC Version: ANY CVE: N/A Risk: High Status: public/not fixed On November 2013 I discovered vulnerability in EMC Documentum Content Server which allow authenticated user to execute arbitrary commands using dmbptransition docbase method for detailed...

EMC Documentum D2 4.1 / 4.2.x < 4.2 P16 / 4.5.x < 4.5 P03 Multiple DQL Injection Vulnerabilities

The EMC Documentum D2 running on the remote host is affected by DQL injection vulnerabilities in the D2CenterstageService.getComments and D2DownloadService.getDownloadUrls services due to a failure to sanitize user-supplied input. A remote, authenticated attacker can exploit these to bypass...

The vulnerability of the EMC Unisphere data storage management program allows a hacker to execute arbitrary code.

The vulnerability of the EMC Unisphere data storage management program with the installed JDWP service is related to code errors. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code remotely...

CVE-2015-0544

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value...

Design/Logic Flaw

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value...

Design/Logic Flaw

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2015-0543

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2015-0543

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2015-0544

EMC Secure Remote Services Virtual Edition ESRS VE 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value...

CVE-2015-0543

CVE-2015-0543 affects EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x prior to 3.06. The issue is insufficient validation of X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and potentially access sensitive information. Affected versions include ESRS VE 3.02–...

CVE-2015-0544

EMC Secure Remote Services Virtual Edition (ESRS VE) before 3.06 is affected by insufficient randomness in session cookie generation, enabling potential session hijacking. Affected versions include ESRS VE 3.02–3.04; EMC released 3.06 to address this issue. The vulnerability is documented as a hi...

ESA-2015-112: EMC Isilon OneFS Command Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-112: EMC Isilon OneFS Command Injection Vulnerability EMC Identifier: ESA-2015-112 CVE Identifier: CVE-2015-4525 Severity Rating: CVSS v2 Base Score: 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C Affected products: • EMC Isilon OneFS 7.2.0.0 - 7.2.0.1 • EMC...