EUVD-2020-26962

Malware in sbrugna...

CVE-2020-5804: Improper Limitation of a Pathname to a Restricted Directory

Marvell QConvergeConsole GUI = 5.5.0.74 is affected by a path traversal vulnerability. The deleteEventLogFile method of the GWTTestServiceImpl class lacks proper validation of a user-supplied path prior to using it in file deletion operations. An authenticated, remote attacker can leverage this...

PT-2021-12476

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole GUI versions = 5.5.0.74 Description: The issue concerns the storage of credentials in cleartext within the tomcat-users.xml file. This allows OS-level users on the host, who are not authorized to use QConvergeConsole,...

PT-2021-12475

Name of the Vulnerable Software and Affected Versions: Marvell QConvergeConsole GUI versions 5.5.0.74 and earlier Description: The issue concerns a path traversal vulnerability. Specifically, the deleteEventLogFile method of the GWTTestServiceImpl class lacks proper validation of a user-supplied...

CVE-2020-5805: Cleartext Storage of Sensitive Information

In Marvell QConvergeConsole GUI = 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. OS-level users on the QCC host who are not authorized to use QCC may use the plaintext credentials to login to QCC...

Path traversal

Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbitrary files on disk as SYSTEM or root...

CVE-2020-5803

CVE-2020-5803 affects Marvell QConvergeConsole GUI 5.5.0.74. It describes a relative path traversal vulnerability that lets a remote, authenticated attacker delete arbitrary files on disk with SYSTEM/root privileges. Exploitation is described as remote and authenticated; no in-wild exploit detail...

PT-2020-18723

Name of the Vulnerable Software and Affected Versions Marvell QConvergeConsole GUI version 5.5.0.74 Description The issue allows a remote, authenticated attacker to delete arbitrary files on disk with elevated privileges, either as SYSTEM or root, due to a Relative Path Traversal vulnerability in...

CVE-2020-5803: Improper Limitation of a Pathname to a Restricted Directory

Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbitrary files on disk as SYSTEM or root...