Default credentials

Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation process. This unnecessary user account also remains even after an upgrade from v1.1 to v1.2. Access to the management console can be achiev...

CVE-2018-1214

Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation process. This unnecessary user account also remains even after an upgrade from v1.1 to v1.2. Access to the management console can be achiev...

CVE-2018-1214

Dell EMC SupportAssist Enterprise (SAE) 1.1 creates a local Windows user account named OMEAdapterUser with a default password during installation. The account persists through upgrades (v1.1 → v1.2) and, when SAE is installed on a server running OpenManage Essentials (OME) , is added to the OmeAd...

CVE-2018-1185

An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Admin CLI may allow a malicious user with admin privileges to escape from the restricted...

Command injection

An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Boxmgmt CLI may allow a malicious user with boxmgmt privileges to bypass Boxmgmt CLI and r...

CVE-2018-1184

An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Boxmgmt CLI may allow a malicious user with boxmgmt privileges to bypass Boxmgmt CLI and r...

Command injection

An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Admin CLI may allow a malicious user with admin privileges to escape from the restricted...

CVE-2018-1185

The CVE-2018-1185 issue affects EMC RecoverPoint for Virtual Machines and RecoverPoint, with vulnerable versions listed as prior to 5.1.1, 5.1.0.0, and prior to 5.0.1.3. The Admin CLI contains a command injection flaw that could let a user with admin privileges escape the restricted shell and exe...

CVE-2018-1184

An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Boxmgmt CLI may allow a malicious user with boxmgmt privileges to bypass Boxmgmt CLI and r...

CVE-2018-1184

CVE-2018-1184 affects EMC RecoverPoint for Virtual Machines (and RecoverPoint for VMs) where the Boxmgmt CLI contains a command-injection vulnerability. The issue allows a malicious user with boxmgmt privileges to bypass the Boxmgmt CLI and execute arbitrary commands with root privileges. Affecte...

CVE-2018-1185

An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1, EMC RecoverPoint version 5.1.0.0, and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Admin CLI may allow a malicious user with admin privileges to escape from the restricted...

EMC RSA Authentication Manager < 8.2 SP1 Patch 7 Security Console Unspecified Blind SQL Injection (ESA-2018-002)

The version of EMC RSA Authentication Manager running on the remote host is prior to 8.2 SP1 Patch 7 8.2.1.7. It is, therefore, affected by a blind SQL injection vulnerability in the Security Console that allows authenticated users to read any unencrypted data from the database. C Tenable Network...

EMC Data Protection Advisor Application Service Static Credentials Authentication Bypass (CVE-2017-8013)

A static credentials authentication bypass vulnerability exists in the EMC Data Protection Advisor Application service...

CVE-2017-15546

The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. Authenticated malicious users could potentially exploit this vulnerability to read any unencrypted data from the database...

Sql injection

The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. Authenticated malicious users could potentially exploit this vulnerability to read any unencrypted data from the database...

CVE-2017-15546

CVE-2017-15546 affects EMC RSA Authentication Manager 8.2 SP1 P6 and earlier. The vulnerability is a blind SQL injection in the Security Console that allows authenticated users to read unencrypted data from the database. Connected sources identify affected versions up to 8.2 SP1 Patch 7 (8.2.1.7)...

CVE-2017-15546

The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. Authenticated malicious users could potentially exploit this vulnerability to read any unencrypted data from the database...

Intel Halts Spectre/Meltdown Patching for Broadwell and Haswell Systems

Intel is advising OEMs and partners to halt patching for the Spectre and Meltdown vulnerabilities amid numerous reports the updates are causing reboot issues on systems running the Broadwell and Haswell microprocessors. “We recommend that OEMs, cloud service providers, system manufacturers,...

Dell EMC Storage Manager EmConfigMigration Servlet Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Dell EMC Storage Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EmConfigMigration servlet, which listens on TCP port 3033 by...

Design/Logic Flaw

An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition NVE 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could potentially upload arbitrary maliciously crafted...