Hardcoded credentials

hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$agent account, which allows remote attackers to obtain access to a management service via a login: request to TCP port 13838...

Code injection

lhn/public/network/ping in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 first, 2 third, or 3 fourth parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4361...

CVE-2012-2986

lhn/public/network/ping in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 first, 2 third, or 3 fourth parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4361...

CVE-2012-2986

lhn/public/network/ping in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 first, 2 third, or 3 fourth parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4361...

CVE-2012-4361

lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter...

CVE-2012-4361

CVE-2012-4361 concerns HP SAN/iQ’s Virtual SAN Appliance, where the component at lhn/public/network/ping allows remote authenticated users to execute arbitrary shell commands by injecting metacharacters in the second parameter. The vulnerability affects HP SAN/iQ versions up to and including 9.4/...

CVE-2012-4362

hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$agent account, which allows remote attackers to obtain access to a management service via a login: request to TCP port 13838...

CVE-2012-4362

CVE-2012-4362 : Affects HP SAN/iQ Virtual SAN Appliance (HP SAN/iQ) before version 9.5. The component hydra.exe uses a hardcoded password, L0CAlu53R, for the global$agent account, enabling remote attackers to obtain access to the management service via a login to TCP port 13838. This description ...

CVE-2012-2986

Affected software/variant: HP SAN/iQ Virtual SAN Appliance (9.5 released prior) with the lhn/public/network/ping component. Vulnerability details: Remote authenticated users can execute arbitrary commands via shell metacharacters in specific parameters (the first, third, or fourth parameter as ci...

PT-2012-5359

Name of the Vulnerable Software and Affected Versions HP SAN/iQ versions prior to 9.5 Description The issue concerns a hardcoded password in hydra.exe for the global$agent account. This hardcoded password is L0CAlu53R, allowing remote attackers to gain access to a management service. The attack...

CVE-2012-4361: Improper Neutralization of Special Elements used in an OS Command

lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter...

CVE-2012-2986: Improper Neutralization of Special Elements used in an OS Command

lhn/public/network/ping in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 first, 2 third, or 3 fourth parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4361...

PT-2012-5358

Name of the Vulnerable Software and Affected Versions HP Virtual SAN Appliance version prior to 9.5 Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter of the 'lhn/public/network/ping' endpoint. Recommendations For...

PT-2012-4416

Name of the Vulnerable Software and Affected Versions HP SAN/iQ version 9.5 on the HP Virtual SAN Appliance Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in certain parameters. This is due to an incomplete fix for a previous issue...

CVE-2012-4362: Undefined Security Weakness

hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$agent account, which allows remote attackers to obtain access to a management service via a login: request to TCP port 13838...

ManageEngine OpStor 7.4 Cross Site Scripting / SQL Injection

Title: ====== ManageEngine OpStor v7.4 - Multiple Web Vulnerabilities Date: ===== 2012-08-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=667 VL-ID: ===== 667 Common Vulnerability Scoring System: ==================================== 8.1 Introduction: =============...

HP Virtual SAN appliance root shell command injection

Overview The HP Virtual SAN appliance version 9.5 is susceptible to a root shell command injection CWE-77 vulnerability. Description Tenable Network Security has reported that HP's fix for the command injection vulnerability, EDB-ID 18893, was incomplete. The ping command for the appliance has a...

ManageEngine OpStor v7.4 - Multiple Web Vulnerabilities

Document Title: =============== ManageEngine OpStor v7.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=667 Release Date: ============= 2012-08-17 Vulnerability Laboratory ID VL-ID: ==================================== 667...

The specified transports are not available

Challenge The SAN or Virtual Appliance mode intermittently fails with the error: Error: Client error: The specified transports are not available. Available transports: nbd. Specified transports: san. VMDK path: Datastore VMname/VMName.vmdk. The following entries can be seen in the VeeamAgent log:...

HP SAN/iQ < 9.5 Root Shell Command Injection

The version of SAN/iQ running on the remote host has a command injection vulnerability. The hydra service, used for remote management and configuration, does not properly sanitize untrusted input. A remote attacker could exploit this to execute arbitrary commands as root. Authentication is...