CVE-2014-4624

EMC Avamar Data Store ADS and Avamar Virtual Edition AVE 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call...

CVE-2014-4620

CVE-2014-4620 affects EMC NetWorker Module for MEDITECH (NMMEDI) 3.0 builds 87–90. When used with EMC RecoverPoint and Plink, Plink commands print RecoverPoint credentials in clear text to nsrmedisv.raw log files, yielding local information disclosure. Impact is sensitive data exposure in logs. R...

CVE-2014-4624

EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x up to 7.0.2-43 expose MCUser and GSAN passwords via Java API calls without authentication (remote information disclosure). VMware vSphere Data Protection (VDP) 5.x also vulnerable via Java API access to retrieve credential...

PT-2014-6030

Name of the Vulnerable Software and Affected Versions EMC Avamar versions 6.0.x through 7.0.x Description The issue allows context-dependent attackers to obtain cleartext passwords via a brute-force attack because UNIX DES crypt is used for password hashing when Password Hardening before version...

PT-2014-6027

Name of the Vulnerable Software and Affected Versions EMC NetWorker Module for MEDITECH aka NMMEDI versions 3.0 build 87 through 3.0 build 90 Description The issue allows local users to obtain sensitive information by reading log files. Specifically, when EMC RecoverPoint and Plink are used,...

CVE-2014-4623: Undefined Security Weakness

EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store ADS GEN4S and Avamar Virtual Edition AVE, when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force atta...

PT-2014-6031

Name of the Vulnerable Software and Affected Versions EMC Avamar Data Store ADS and Avamar Virtual Edition AVE versions 6.x and 7.0.x through 7.0.2-43 Description The issue allows remote attackers to discover grid MCUser and GSAN passwords via a crafted Java API call, as no authentication is...

CVE-2014-4624: Undefined Security Weakness

EMC Avamar Data Store ADS and Avamar Virtual Edition AVE 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call...

CVE-2014-4620: Exposure of Sensitive Information to an Unauthorized Actor

The EMC NetWorker Module for MEDITECH aka NMMEDI 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files...

EMC RSA Identity Management and Governance authentication bypass

Authentication bypass if NovellIM is used...

ESA-2014-081 RSA® Identity Management and Governance Authentication Bypass Vulnerability

ESA-2014-081.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-081 RSA® Identity Management and Governance Authentication Bypass Vulnerability EMC Identifier: ESA-2014-081 CVE Identifier: CVE-2014-4619 Severity Rating: CVSS v2 Base Score: 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C Affected products:...

EMC AlphaStor Device Manager Opcode 0x75 Command Injection

No description provided by source. require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp include Msf::Exploit::CmdStager def initializeinfo = superupdateinfoinfo, 'Name' = 'EMC AlphaStor Device Manager Opcode 0x75 Command Injection',...

EMC Documentum Content Server Multiple Privilege Escalation Vulnerabilities (ESA-2014-091)

The remote host is running a version of EMC Documentum Content Server that is affected by multiple vulnerabilities : - A privilege escalation vulnerability exists due to improper handling of system objects that allows a user to escalate their privileges to super-user status. CVE-2014-4621 - A...

EMC AlphaStor Device Manager Opcode 0x75 Command Injection Exploit

This Metasploit module exploits a flaw within the Device Manager rrobtd.exe. When parsing the 0x75 command, the process does not properly filter user supplied input allowing for arbitrary command injection. This Metasploit module has been tested successfully on EMC AlphaStor 4.0 build 116 with...

EMC AlphaStor Agent 3.1 缓冲区溢出漏洞

No description provided by source...

EMC Replication Manager 5.2.1 命令执行漏洞

No description provided by source...

EMC AlphaStor Device Manager Opcode 0x75 Command Injection

require 'msf/core' class Metasploit3 'EMC AlphaStor Device Manager Opcode 0x75 Command Injection', 'Description' = %q This module exploits a flaw within the Device Manager rrobtd.exe. When parsing the 0x75 command, the process does not properly filter user supplied input allowing for arbitrary...

EMC AlphaStor Device Manager Opcode 0x75 - Command Injection (Metasploit)

require 'msf/core' class Metasploit3 'EMC AlphaStor Device Manager Opcode 0x75 Command Injection', 'Description' = %q This module exploits a flaw within the Device Manager rrobtd.exe. When parsing the 0x75 command, the process does not properly filter user supplied input allowing for arbitrary...

ESA-2014-091: EMC Documentum Content Server Multiple Privilege Escalation Vulnerabilities

ESA-2014-091.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-091: EMC Documentum Content Server Multiple Privilege Escalation Vulnerabilities EMC Identifier: ESA-2014-091 CVE Identifier: CVE-2014-4621, CVE-2014-4622 Severity Rating: CVSS v2 Base Score: See below for individual scores f...

CVE-2014-4621

EMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subtypes of protected system types, which allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions ...