Authentication flaw

The NetWorker Management Console NMC in EMC NetWorker 8.0.x before 8.0.2.3, when using Active Directory/LDAP for authentication, allows remote authenticated users to discover cleartext administrator passwords via 1 unspecified NMC audit reports or 2 requests to RAP resources...

CVE-2013-3285

The NetWorker Management Console NMC in EMC NetWorker 8.0.x before 8.0.2.3, when using Active Directory/LDAP for authentication, allows remote authenticated users to discover cleartext administrator passwords via 1 unspecified NMC audit reports or 2 requests to RAP resources...

CVE-2013-3287

EMC Unisphere for VMAX prior to version 1.6.1.6 is affected. If an unspecified level of LDAP debug logging is enabled, local users can read the LDAP bind password in cleartext from the console output. Remediation shown across sources: upgrade to Unisphere for VMAX 1.6.1.6 and/or change the LDAP b...

CVE-2013-3285

The CVE-2013-3285 issue affects EMC NetWorker 8.0.x prior to 8.0.2.3, where the NetWorker Management Console (NMC) using Active Directory/LDAP can allow a remote authenticated user to discover cleartext administrator passwords via NMC audit reports or RAP resource requests. The advisory details t...

CVE-2013-3287

EMC Unisphere for VMAX before 1.6.1.6, when using an unspecified level of debug logging in LDAP configurations, allows local users to discover the cleartext LDAP bind password by reading the console...

EMC NetWorker 8.x < 8.0.2.3 Management Console Information Disclosure

The version of EMC NetWorker is 8.x earlier than 8.0.2.3. As such, it is potentially affected by an information disclosure vulnerability. When the NetWorker Management Console is configured to use Active Directory/LDAP for authentication, an authenticated user may be able to see the AD/LDAP...

CVE-2013-3280

EMC RSA Authentication Agent 7.1.x before 7.1.2 for Web for Internet Information Services has a fail-open design, which allows remote attackers to bypass intended access restrictions via vectors that trigger an agent crash...

Design/Logic Flaw

EMC RSA Authentication Agent 7.1.x before 7.1.2 for Web for Internet Information Services has a fail-open design, which allows remote attackers to bypass intended access restrictions via vectors that trigger an agent crash...

CVE-2013-3280

EMC RSA Authentication Agent 7.1.x before 7.1.2 for Web for Internet Information Services has a fail-open design, which allows remote attackers to bypass intended access restrictions via vectors that trigger an agent crash...

CVE-2013-3280

CVE-2013-3280 concerns the RSA Authentication Agent for Web for IIS (RSA Authentication Agent for IIS) in the 7.1.x line (pre-7.1.2). The vulnerability stems from a fail-open design that can allow an attacker to bypass access controls by triggering an agent crash, potentially leaving protected re...

EMC Replication Manager Command Execution Vulnerability

This Metasploit module exploits a remote command-injection vulnerability in EMC Replication Manager client irccd.exe. By sending a specially crafted message invoking RunProgram function an attacker may be able to execute arbitrary code commands with SYSTEM privileges. Affected products are EMC...

EMC Replication Manager Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'EMC Replication Manager Command Execution', 'Description' = %q This module exploits a remote command-injection vulnerability in EMC...

CVE-2013-3279

EMC Atmos before 2.1.4 has a blank password for the PostgreSQL account, which allows remote attackers to obtain sensitive administrative information via a database-server connection...

Design/Logic Flaw

EMC Atmos before 2.1.4 has a blank password for the PostgreSQL account, which allows remote attackers to obtain sensitive administrative information via a database-server connection...

CVE-2013-3279

EMC Atmos before 2.1.4 has a blank password for the PostgreSQL account, which allows remote attackers to obtain sensitive administrative information via a database-server connection...

CVE-2013-3279

EMC Atmos before 2.1.4 uses a default/blank PostgreSQL password, allowing remote attackers to connect to the database server and obtain sensitive administrative information. Affected: Atmos software on all supported hardware/VE prior to 2.1.4. Root cause: unauthenticated access due to no password...

ESA-2013-047: RSA® Authentication Agent for PAM Unlimited Login Attempts Vulnerability

ESA-2013-047.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-047: RSA® Authentication Agent for PAM Unlimited Login Attempts Vulnerability EMC Identifier: ESA-2013-047 CVE Identifier: CVE-2013-3271 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected Products: R...

EMC Atmos weak default installation

Default database access with no password is allowed...

ESA-2013-062: EMC Atmos Unauthenticated Database Access Vulnerability

ESA-2013-062.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-062: EMC Atmos Unauthenticated Database Access Vulnerability EMC Identifier: ESA-2013-062 CVE Identifier: CVE-2013-3279 Severity Rating: CVSS v2 Base Score: CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P Affected products: • All version...

CVE-2013-3278

EMC VPLEX before VPLEX GeoSynchrony 5.2 SP1 uses cleartext for storage of the LDAP/AD bind password, which allows local users to obtain sensitive information by reading the management-server configuration file...