CVE-2017-8019

An issue was discovered in EMC ScaleIO 2.0.1.x. A vulnerability in message parsers MDM, SDS, and LIA could potentially allow an unauthenticated remote attacker to send specifically crafted packets to stop ScaleIO services and cause a denial of service situation...

CVE-2017-8020

An issue was discovered in EMC ScaleIO 2.0.1.x. A buffer overflow vulnerability in the SDBG service may potentially allow a remote unauthenticated attacker to execute arbitrary commands with root privileges on an affected server...

CVE-2017-14379

The CVE-2017-14379 entry concerns EMC RSA Authentication Manager prior to 8.2 SP1 Patch 6 (8.2.1.6) with a stored cross-site scripting (XSS) flaw affecting the Security Console. The underlying issue is a stored XSS vulnerability in the web application that could allow a remote attacker to execute...

CVE-2017-8001

CVE-2017-8001 affects EMC ScaleIO 2.0.1.x on Linux. A support script saves the ScaleIO MDM user’s credentials in clear text to temporary log files, which may be readable by an unprivileged user with server access. Root cause: credentials stored in clear text in temp files. Documented impact inclu...

CVE-2017-8020

CVE-2017-8020 affects EMC ScaleIO 2.0.1.x; a buffer overflow in the SDBG service may allow a remote unauthenticated attacker to execute arbitrary commands with root privileges on the affected server. Connected documents corroborate the product/version and root cause (buffer overflow in SDBG), and...

CVE-2017-14379

EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-8019

CVE-2017-8019 affects EMC ScaleIO 2.0.1.x. A vulnerability in the message parsers used by MDM, SDS, and LIA could allow an unauthenticated remote attacker to send specially crafted packets to stop ScaleIO services, causing a denial-of-service. The issue is triggered by parsing crafted messages; n...

EMC ScaleIO for Linux Information Disclosure Vulnerability

EMC ScaleIO for Linux is a software-defined solution for converting DAS storage to shared data block storage based on the Linux platform from EMC. An information disclosure vulnerability exists in EMC ScaleIO version 2.0.1.x for Linux-based platforms, which originates when the program saves the...

EMC RSA Authentication Manager Cross-Site Scripting Vulnerability (CNVD-2017-35692)

EMC RSA Authentication Manager is a centralized binary authentication software from EMC. The software centralizes the management of binary authentication, security tokens, methods and users across physical sites. A cross-site scripting vulnerability exists in versions of EMC RSA Authentication...

EMC ScaleIO 2.0.1.x Buffer Overflow / Information Disclosure Vulnerabilities

EMC ScaleIO versions 2.0.1.3, 2.0.1.2, 2.0.1.1, and 2.0.1 suffer from information disclosure, denial of service, and buffer overflow vulnerabilities. ESA-2017-094: EMC ScaleIO Multiple Vulnerabilities EMC Identifier: ESA-2017-094 CVE Identifier: CVE-2017-8001, CVE-2017-8019, CVE-2017-8020 Severit...

EMC Unisphere For VMAX vApp Manager ORBServlet Remote Credential Creation Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of EMC Unisphere For VMAX vApp Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ORBServlet. The vulnerability is caused by improper...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of November 6, 2017

I started a 14-day detox this week that eliminates common food allergens and hormones. It’s going to be two weeks of no fun, but it’s good to give your body a little reset. Plus, I’ll be done just in time for the Thanksgiving holiday. Eliminating toxins from your body can be compared to eliminati...

EMC Solutions Enabler Virtual Appliance < 8.4.0.15 Authentication Bypass Vulnerability

The version of EMC Solutions Enabler Virtual Appliance running on the remote host is prior to 8.4.0.15. It is, therefore, affected by an authentication bypass vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104389; scriptversion"1.9";...

EMC Unisphere for VMAX Virtual Appliance < 8.4.0.15 Authentication Bypass Vulnerability

The version of EMC Unisphere for VMAX Virtual Appliance running on the remote host is prior to 8.4.0.15. It is, therefore, affected by an authentication bypass vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104390; scriptversion"1.9";...

EMC VMAX VASA Provider Virtual Appliance < 8.4.0.512 Authentication Bypass Vulnerability

The version of EMC VMAX VASA Provider Virtual Appliance running on the remote host is prior to 8.4.0.512. It is, therefore, affected by an authentication bypass vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid104391; scriptversion"1.10";...

EMC RSA Authentication Manager < 8.2 SP1 Patch 5 Reflected Cross-Site Scripting (ESA-2017-134)

The version of EMC RSA Authentication Manager running on the remote host is prior to 8.2 SP1 Patch 5 8.2.1.5. It is, therefore, affected by a reflected cross-site scripting vulnerability via an argument in the HTTP POST request. Attackers could potentially exploit this vulnerability to execute...

CVE-2017-14376

EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise the affected system...

Authentication flaw

EMC Unisphere for VMAX Virtual Appliance vApp versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtual Appliance versions prior to 8.4.0.512, and EMC VMAX Embedded Management eManagement versions prior to and including 1.4 Enginuity Release...

Hardcoded credentials

EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-14375

EMC Unisphere for VMAX Virtual Appliance vApp versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtual Appliance versions prior to 8.4.0.512, and EMC VMAX Embedded Management eManagement versions prior to and including 1.4 Enginuity Release...