SEC Consult SA-20130507-0 :: Multiple vulnerabilities in NetApp OnCommand System Manager

SEC Consult Vulnerability Lab Security Advisory 20130507-0 ======================================================================= title: Multiple vulnerabilities product: NetApp OnCommand System Manager vulnerable version: = 2.1 and =2.0.2 fixed version: 2.2 only XSS fixed CVE: CVE-2013-3320 XSS...

NetApp OnCommand System Manager - '/zapiServlet' User Management Interface Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/59688/info NetApp OnCommand System Manager is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run...

NetApp OnCommand System Manager - zapiServlet CIFS Configuration Management Interface Multiple Cross-Site Scripting Vulnerabilities

NetApp OnCommand System Manager - zapiServlet CIFS Configuration Management Interface Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/59688/info NetApp OnCommand System Manager is prone to multiple cross-site scripting and HTML-injection vulnerabilities...

NetApp OnCommand System Manager 2.1 / 2.0.2 XSS / File Inclusion / Command Execution

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: NetApp OnCommand System Manager vulnerable version: = 2.1 and =2.0.2 fixed version: 2.2 only XSS fixed CVE: CVE-2013-3320 XSS...

NetApp OnCommand System Manager - zapiServlet User Management Interface Multiple Cross-Site Scripting Vulnerabilities

NetApp OnCommand System Manager - zapiServlet User Management Interface Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/59688/info NetApp OnCommand System Manager is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails ...

NetApp OnCommand System Manager - '/zapiServlet' CIFS Configuration Management Interface Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/59688/info NetApp OnCommand System Manager is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run...

SuSE9 Security Update : multipath-tools (YOU Patch Number 12377)

The default permissions on the multipathd socket file were to generous and allowed any user to connect. CVE-2009-0115 This update also contains the following fixes : - multipathd is not started for single paths bnc473841 - Backport maxfds parameter bnc457632 - Rename NetApp prio callout to 'ontap...

CVE-2008-3349

Multiple unspecified vulnerabilities in NetApp Data ONTAP, as used on NetApp and IBM eServer platforms, allow remote attackers to execute arbitrary commands, cause a denial of service system crash, or obtain sensitive information, probably related to insufficient access control for HTTP requests...

CVE-2008-3349

Multiple unspecified vulnerabilities in NetApp Data ONTAP, as used on NetApp and IBM eServer platforms, allow remote attackers to execute arbitrary commands, cause a denial of service system crash, or obtain sensitive information, probably related to insufficient access control for HTTP requests...

CVE-2008-3349

CVE-2008-3349 concerns multiple unspecified vulnerabilities in NetApp Data ONTAP (used on NetApp and IBM eServer platforms) that allow remote attackers to execute arbitrary commands, cause a denial of service (system crash), or obtain sensitive information, probably due to insufficient access con...

NetApp Data ONTAP contains multiple vulnerabilities

Overview NetApp Data ONTAP contains multiple vulnerabilities. The most severe of these vulnerabilities may allow an attacker to execute commands, view sensitive data, or cause a system to crash. Description NetApp Data ONTAP contains multiple undisclosed vulnerabilities. --- Impact A remote,...

DEBIAN-CVE-2008-0960

SNMPv3 HMAC verification in 1 Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; 2 UCD-SNMP; 3 eCos; 4 Juniper Session and Resource Control SRC C-series 1.0.0 through 2.0.0; 5 NetApp aka Network Appliance Data ONTAP 7.3RC1 and 7.3RC2; 6 SNMP Research before 16.2; 7...

CVE-2008-0960

CVE-2008-0960 describes an SNMPv3 HMAC verification flaw where the client specifies the HMAC length, enabling spoofing of authenticated SNMPv3 packets. Affected implementations include Net-SNMP 5.2.x (pre-5.2.4.1), 5.3.x (pre-5.3.2.1), 5.4.x (pre-5.4.1.1); UCD-SNMP; eCos; Juniper SRC C-series (1....

net-snmp SNMPv3 authentication bypass (VU#877044)

SNMPv3 HMAC verification in 1 Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; 2 UCD-SNMP; 3 eCos; 4 Juniper Session and Resource Control SRC C-series 1.0.0 through 2.0.0; 5 NetApp aka Network Appliance Data ONTAP 7.3RC1 and 7.3RC2; 6 SNMP Research before 16.2; 7...

net-snmp SNMPv3 authentication bypass (VU#877044)

SNMPv3 HMAC verification in 1 Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; 2 UCD-SNMP; 3 eCos; 4 Juniper Session and Resource Control SRC C-series 1.0.0 through 2.0.0; 5 NetApp aka Network Appliance Data ONTAP 7.3RC1 and 7.3RC2; 6 SNMP Research before 16.2; 7...

CVE-2008-0960

SNMPv3 HMAC verification in 1 Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; 2 UCD-SNMP; 3 eCos; 4 Juniper Session and Resource Control SRC C-series 1.0.0 through 2.0.0; 5 NetApp aka Network Appliance Data ONTAP 7.3RC1 and 7.3RC2; 6 SNMP Research before 16.2; 7...

CVE-2006-3569

Unspecified vulnerability in NetApp Data ONTAP 7.0x through 7.0.4P8D9, 7.1x, 7.1.0.1x, and 7.2RC1, RC2, and RC3, as used in IBM N series Filers and other products, allows unauthorized users to gain access to privileged commands via unknown vectors, probably related to incorrect capabilities with...

CVE-2006-3569

CVE-2006-3569 affects NetApp Data ONTAP 7.0x through 7.0.4P8D9, 7.1x, 7.1.0.1x, and 7.2 RC1/RC2/RC3 used in IBM N-Series Filers. The vulnerability permits unauthorized users to access privileged commands via unknown vectors, likely due to incorrect capabilities assigned to the audit role. Documen...

CVE-2006-3569

Unspecified vulnerability in NetApp Data ONTAP 7.0x through 7.0.4P8D9, 7.1x, 7.1.0.1x, and 7.2RC1, RC2, and RC3, as used in IBM N series Filers and other products, allows unauthorized users to gain access to privileged commands via unknown vectors, probably related to incorrect capabilities with...

[Full-disclosure] Network Appliance iSCSI Authentication Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Security Advisory: Network Appliance iSCSI Authentication Bypass Origin Date: Wed Aug 3 2005 Publication Date: Mon Oct 24 2005 Synopsis Unauthenticated iSCSI Initiators can bypass iSCSI authentication on NetApp Filers by manipulating the iSCSI Login...