Design/Logic Flaw

IBM Storwize 3500, 3700, 5000, and 7000 devices and SAN Volume Controller 6.x and 7.x before 7.2.0.8 allow remote attackers to reset the administrator superuser password to its default value via a direct request to the administrative IP address...

CVE-2014-4811

IBM Storwize 3500, 3700, 5000, and 7000 devices and SAN Volume Controller 6.x and 7.x before 7.2.0.8 allow remote attackers to reset the administrator superuser password to its default value via a direct request to the administrative IP address...

CVE-2014-4811

Summary (CVE-2014-4811) IBM Storwize family (V3500, V3700, V5000, V7000) and SAN Volume Controller prior to 7.2.0.8 are vulnerable. An unauthorized remote user with network access to the system’s administrative IP can reset the administrator superuser password to a default value via a web browser...

IBM Storwize V7000 Unified Service Account Unspecified Local Privilege Escalation

The remote host is affected by an unspecified local privilege escalation vulnerability that can be exploited through an IBM service account on the device. Note that Nessus has not checked if the remote device has been patched. The device should be checked manually to confirm if the host is...

CVE-2014-3043

IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.3 allows remote authenticated users to gain privileges by leveraging access to the service account...

Code injection

IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.3 allows remote authenticated users to gain privileges by leveraging access to the service account...

CVE-2014-3043

IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.3 allows remote authenticated users to gain privileges by leveraging access to the service account...

CVE-2014-3043

The CVE-2014-3043 issue affects IBM Storwize V7000 Unified, with affected code releases 1.3.x and 1.4.x up to 1.4.3.2. The vulnerability allows remote authenticated users to obtain unauthorized privileges by abusing the IBM service account. IBM security bulletins confirm a fix is available in ver...

CVE-2014-0875

Active Cloud Engine ACE in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions...

Design/Logic Flaw

Active Cloud Engine ACE in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions...

CVE-2014-0875

IBM Storwize V7000 Unified ACE contains a race condition in NFS retransmissions that can bypass ACLs, affecting releases 1.3.0.0–1.4.3.x. A fix is available in 1.5.0.0 or later; upgrade to mitigate. The issue arises when ACE manages ACLs during network retransmissions and could grant unauthorized...

CVE-2014-0875

Active Cloud Engine ACE in IBM Storwize V7000 Unified 1.3.0.0 through 1.4.3.x allows remote attackers to bypass intended ACL restrictions in opportunistic circumstances by leveraging incorrect ACL synchronization over an unreliable NFS connection that requires retransmissions...

IBM Storwize Web Management Interface Detection

Binary data ibmstorwizewebmanagerdetect.nbin...

IBM Storwize Authenticated Information Disclosure

The remote Storwize device is a model that is affected by an authenticated information disclosure vulnerability. In the event of a hardware fault, memory contents containing customer data may be written to a file that can be read by an authenticated user of the system who may not otherwise have...

CVE-2013-6737

IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.0 does not properly restrict the content of a dump file upon encountering a 1691 hardware fault, which allows remote authenticated users to obtain sensitive customer-data fragments by reading this file after it is copied...

CVE-2013-6737

IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.3.0 does not properly restrict the content of a dump file upon encountering a 1691 hardware fault, which allows remote authenticated users to obtain sensitive customer-data fragments by reading this file after it is copied...

CVE-2013-6737

CVE-2013-6737 affects IBM System Storage Storwize V7000 Unified 1.3.x and 1.4.x prior to 1.4.3.0, where a rare hardware fault (1691) can cause fragments of customer data to be dumped into a file. An authorized user may copy this file and read the data fragments, potentially compromising confident...

CVE-2014-0880

IBM SAN Volume Controller; Storwize V3500, V3700, V5000, and V7000; and Flex System V7000 with software 6.3 and 6.4 before 6.4.1.8, and 7.1 and 7.2 before 7.2.0.3, allow remote attackers to obtain CLI access, and consequently cause a denial of service, via unspecified traffic to the administrativ...

CVE-2014-0880

CVE-2014-0880 affects IBM SAN Volume Controller and Storwize family (V3500/V3700/V5000/V7000 and Flex System V7000; Lenovo/IBM code lines 6.3–7.2). Root cause: an unauthorized network-grade user can access the system’s administrative IP and gain CLI access, enabling issuance of all administrative...

CVE-2014-0880

IBM SAN Volume Controller; Storwize V3500, V3700, V5000, and V7000; and Flex System V7000 with software 6.3 and 6.4 before 6.4.1.8, and 7.1 and 7.2 before 7.2.0.3, allow remote attackers to obtain CLI access, and consequently cause a denial of service, via unspecified traffic to the administrativ...