CVE-2017-8131

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with...

CVE-2017-8135

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with...

PT-2017-18140

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10 Description The issue is related to a command injection vulnerability caused by insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit...

PT-2017-18192

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00SPC102NFV Description The issue is related to a command injection vulnerability due to a lack of validation. This allows an attacker with high privileges to inject malicious code into certain modules o...

PT-2017-18193

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00SPC102NFV Description The issue is related to a path traversal vulnerability due to insufficient path validation. An attacker with high privilege may exploit this to overwrite certain files, resulting ...

CVE-2017-2719: Improper Neutralization of Special Elements used in a Command

FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands...

CVE-2017-2718: Improper Neutralization of Special Elements used in a Command

FusionSphere OpenStack with software V100R006C00 and V100R006C10RC2 has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands...

CVE-2017-2714: Improper Restriction of Operations within the Bounds of a Memory Buffer

The GaussDB in FusionSphere OpenStack V100R005C10SPC705 and earlier versions has a buffer overflow vulnerability. An authenticated attacker on the LAN can exploit this vulnerability to execute arbitrary code or cause a denial of service DoS condition in the affected system...

CVE-2017-8194: Improper Authentication

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

PT-2017-18143

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10 Description The issue is related to a command injection vulnerability caused by insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit...

PT-2017-18195

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00SPC102NFV Description The issue is related to a weak cryptographic algorithm, which can be exploited by attackers to crack cipher text, potentially leading to information leaks on transmission links...

CVE-2017-8134: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with...

PT-2017-15507

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00 Description The software has an information exposure issue due to the use of a hard-coded cryptographic key for encrypting messages between certain components. This significantly increases the risk th...

CVE-2017-2720: Use of Hard-coded Credentials

FusionSphere OpenStack V100R006C00 has an information exposure vulnerability. The software uses hard-coded cryptographic key to encrypt messages between certain components, which significantly increases the possibility that encrypted data may be recovered and results in information exposure...

PT-2017-15505

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10RC2 Description The issue is related to command injection vulnerabilities due to insufficient input validation on one port. An attacker can exploit these vulnerabilities to gain ro...

PT-2017-18144

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10 Description The issue is related to a command injection vulnerability caused by insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit...

CVE-2017-8195: Improper Authentication

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

CVE-2017-8193: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack V100R006C00SPC102NFV has a command injection vulnerability. Due to the insufficient input validation on one port, an authenticated, local attacker may exploit the vulnerability to gain root privileges by sending message with malicious commands...

CVE-2017-8168: Missing Encryption of Sensitive Data

FusionSphere OpenStack with software V100R006C00SPC102NFV and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive...

CVE-2017-8191: Use of a Broken or Risky Cryptographic Algorithm

FusionSphere OpenStack V100R006C00SPC102NFVhas a week cryptographic algorithm vulnerability. Attackers may exploit the vulnerability to crack the cipher text and cause information leak on the transmission links...