TWSL2010-003: Unauthorized access to root NFS export on EMC Celerra NAS appliance

Trustwave's SpiderLabs Security Advisory TWSL2010-003: Unauthorized access to root NFS export on EMC Celerra Network Attached Storage NAS appliance https://www.trustwave.com/spiderlabs/advisories/TWSL2010-003.txt Published: 2010-07-29 Version: 1.0 Vendor: EMC http://www.emc.com Product: Celerra...

CVE-2010-2860

The EMC Celerra Network Attached Storage NAS appliance accepts external network traffic to IP addresses intended for an intranet network within the appliance, which allows remote attackers to read, create, or modify arbitrary files in the user data directory via NFS requests...

Code injection

The EMC Celerra Network Attached Storage NAS appliance accepts external network traffic to IP addresses intended for an intranet network within the appliance, which allows remote attackers to read, create, or modify arbitrary files in the user data directory via NFS requests...

CVE-2010-2860

EMC Celerra NAS is affected by CVE-2010-2860. The NFS server exports the root ("/") and accepts internal IPs on the private network from external sources, enabling an attacker to read, create, or modify files in the user data directory via NFS requests. Exploitation in Trustwave/EMC advisories in...

EMC Celerra NAS Appliance - Unauthorized Access to Root NFS Export

EMC Celerra NAS Appliance - Unauthorized Access to Root NFS Export Trustwave's SpiderLabs Security Advisory TWSL2010-003: Unauthorized access to root NFS export on EMC Celerra Network Attached Storage NAS appliance https://www.trustwave.com/spiderlabs/advisories/TWSL2010-003.txt Published:...

Iomega smbwebclient.php Unauthenticated Filesystem Access

The remote host appears to be an Iomega device, perhaps a Home Media Network Hard Drive, a Network-attached storage NAS device intended for the home networks. Its web server hosts an unsecured install of smbwebclient, a PHP- based utility that grants full access to any visible shares on the devic...

Simple Machines Forum XSS / XSRF / PHP Execution

This is the first batch of vulnerabilities found by the SimpleAudit team from elhacker.net http://labs.elhacker.net/simpleaudit Our goal is to evaluate the security of SMF 2.0 before using it on our own server, and we have found several security vulnerabilities. The vulnerabilities that also appl...

JVN#89791790 Cross-site scripting vulnerability in FreeNAS

FreeNAS is a NAS Network Attached Storage server software. FreeNAS contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information provided by the developer...

JVN#15267895 Cross-site request forgery vulnerability in FreeNAS

FreeNAS is a NAS Network Attached Storage server software. FreeNAS contains a cross-site request forgery vulnerability. Impact If a user views a malicious web page while logged into the web-based interface, an attacker could modify configurations or delete data on the hard disk drive. Solution...

Thecus NAS Device Detection

According to its web server, the remote host is a Thecus NAS Network- Attached Storage device, which provides file-based data storage to hosts across a network. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid35820; scriptversion"1.12"; scriptnameenglish:"Thecus NAS...

CVE-2008-4790

The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors...

Cisco IOS 12.3(18) FTP Server Remote Exploit (attached to gdb)

Exploit for hardware platform in category remote exploits ============================================================== Cisco IOS 12.318 FTP Server Remote Exploit attached to gdb ============================================================== / Cisco IOS FTP server remote exploit by Andy Davis 20...

Multiple email clients vulnerable to directory traversal due to inappropriate unicode handling

Overview Some email clients contain a vulnerability when handling an attached file with a file name using unicode. This may result in a directory traversal attack or displaying a file name diffrently from the actual file name. Impact Actual impact could differ depending on the email clients thoug...

Adobe Album Starter 3.2 - Unchecked Local Buffer Overflow

Exploitable issue in various Adobe products c0ntex [email protected] Scott Laurie February 2008 Vulnerable applications, tested: Adobe Photoshop Album Starter Adobe After Effects CS3 Adobe Photoshop CS3 Not Vulnerable applications, tested: Adobe Reader Adobe Flash Player This bug is related to th...

Microsoft Jet Engine MDB File Parsing Stack Overflow PoC

No description provided by source. Microsoft Jet Engine MDB File Parsing Stack Overflow Vulnerability by cocoruderfrankruderathotmail.com http://ruder.cdut.net Summary: A remote code execute vulnerability exists in Microsoft Jet...

Improper access control

The projectissueaccess function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests...

CVE-2007-0506

The projectissueaccess function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests...

CVE-2007-0506

The projectissueaccess function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests...

Symantec AntiVirus Decomposition Buffer Overflow

SUMMARY Symantec is aware of a buffer overflow in its AntiVirus component used to decompose RAR Roshal Archive. A specially crafted RAR file could potentially cause this buffer overflow to occur and possibly execute hostile content from the RAR file on the targeted system. Risk Impact High Remote...

CVE-2002-1863

Iomega Network Attached Storage NAS A300U, and possibly other models, does not allow the FTP service to be disabled, which allows local users to access home directories via FTP even when access to all shared directories have been disabled...