PT-2015-4683

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 through SP1 EMC Documentum D2 versions 4.0 EMC Documentum D2 versions 4.1 before 4.1 P22 EMC Documentum D2 versions 4.2 before P11 Description The issue allows remote authenticated users to obtain superuser...

PT-2015-4682

Name of the Vulnerable Software and Affected Versions EMC Documentum D2 versions 3.1 through SP1 EMC Documentum D2 version 4.0 EMC Documentum D2 versions 4.1 before 4.1 P22 EMC Documentum D2 versions 4.2 before P11 Description The issue allows remote authenticated users to obtain sensitive...

PT-2015-4684

Name of the Vulnerable Software and Affected Versions EMC Captiva Capture versions 7.0 through 7.0 before patch 25 EMC Captiva Capture versions 7.1 through 7.1 before patch 13 Description The issue concerns the InputAccel Database installation process, which stores a cleartext InputAccel SQL...

CVE-2015-0517: Exposure of Sensitive Information to an Unauthorized Actor

The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file...

CVE-2015-0519: Exposure of Sensitive Information to an Unauthorized Actor

The InputAccel Database IADB installation process in EMC Captiva Capture 7.0 before patch 25 and 7.1 before patch 13 places a cleartext InputAccel IA SQL password in a DAL log file, which allows local users to obtain sensitive information by reading a file...

CVE-2015-0518: Undefined Security Weakness

The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies group permissions...

EMC Documentum D2 < 4.1 P22 / 4.2 P11 Multiple Vulnerabilities (ESA-2015-010)

The remote host is running a version EMC Documentum D2 prior to 4.1 P22 / 4.2 P11. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to the D2-API component logging the MD5 hash of the passphrase used to encrypt sensitive information and...

CVE-2015-0512

Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

Open redirect

Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

CVE-2015-0512

Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

CVE-2015-0512

Open redirect vulnerability (CVE-2015-0512) in EMC Unisphere Central prior to 4.0. Affected component: Unisphere Central web interface. Description: an unvalidated redirect parameter could send users to arbitrary external sites, enabling phishing by manipulation of the URL. CVSSv2 base score 5.8 ...

CVE-2015-0512: Undefined Security Weakness

Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

EMC Avamar certificate protection bypass

Insufficient certificate validation...

PT-2015-4677

Name of the Vulnerable Software and Affected Versions EMC Unisphere Central versions prior to 4.0 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter. Recommendations For versions prior to 4.0, update to...

ESA-2015-006: EMC Avamar Missing Certificate Validation Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-006: EMC Avamar Missing Certificate Validation Vulnerability EMC Identifier: ESA-2015-006 CVE Identifier: CVE-2014-4632 Severity Rating: CVSSv2 Base Score: 7.9 AV:A/AC:M/Au:N/C:C/I:C/A:C Affected products: • EMC Avamar Data Store ADS and Avam...

EMC Unisphere Central open redirect

Open redirect in web interface...

Design/Logic Flaw

VMware vSphere Data Protection VDP 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store ADS and Avamar Virtual Edition AVE 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoo...

CVE-2014-4632

VMware vSphere Data Protection VDP 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store ADS and Avamar Virtual Edition AVE 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoo...

CVE-2014-4632

VMware vSphere Data Protection VDP 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store ADS and Avamar Virtual Edition AVE 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoo...

CVE-2014-4632

Affected products: VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1; also the EMC Avamar proxy client components (ADS/AVE) 6.x and 7.0.x. Root cause: SSL certificate validation is insufficient; VDP and Avamar proxy fail to properly verify X.509 certificates from vC...