PT-2013-2728

Name of the Vulnerable Software and Affected Versions EMC RSA Archer versions 5.x before 5.3SP1 Archer Smart Suite Framework versions 4.x Description The issue allows remote authenticated users to bypass intended access restrictions and modify global reports. Recommendations For EMC RSA Archer...

PT-2013-2726

Name of the Vulnerable Software and Affected Versions EMC RSA Archer versions 5.x before 5.3SP1 Archer Smart Suite Framework versions 4.x Description The issue allows remote authenticated users to bypass intended access restrictions and upload arbitrary files. Recommendations For EMC RSA Archer...

EMC RSA Archer multiple security vulnerabilities

Code execution, crosite scripting, authorization bypass...

EMC Networker privilege escalation

Weak file permissions...

ESA-2013-035: EMC Avamar Client Improper Certificate Validation Vulnerability

ESA-2013-035.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-035: EMC Avamar Client Improper Certificate Validation Vulnerability EMC Identifier: ESA-2013-035 CVE Identifier: CVE-2013-0945 Severity Rating: CVSS v2 Base Score: 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C Affected products: EMC Avamar...

ESA-2013-028: EMC NetWorker Elevation of Privilege Vulnerability

ESA-2013-028.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-028: EMC NetWorker Elevation of Privilege Vulnerability EMC Identifier: ESA-2013-028 EMC Identifier: NW147983 CVE Identifier: CVE-2013- 0940 Severity Rating: CVSS v2 Base Score: 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C Affected product...

EMC Avamar server / client security vulnerabilities

Unauthorized files access, insufficient certificate validation...

ESA-2013-034: EMC Avamar Improper Authorization vulnerability

ESA-2013-034.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-034: EMC Avamar Improper Authorization vulnerability EMC Identifier: ESA-2013-034 CVE Identifier: CVE-2013-0944 Severity Rating: CVSS v2 Base Score: 7.5 AV:N/AC:M/Au:S/C:C/I:P/A:P Affected products: • EMC Avamar Server 5.x •...

CVE-2013-0944

The web-based file-restore interface in EMC Avamar Server before 6.1.0 allows remote authenticated users to read arbitrary files via a crafted URL...

CVE-2013-0945

EMC Avamar Client before 6.1.101-89 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-0940

The nsrpush process in the client in EMC NetWorker before 7.6.5.3 and 8.x before 8.0.1.4 sets weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors...

Code injection

The web-based file-restore interface in EMC Avamar Server before 6.1.0 allows remote authenticated users to read arbitrary files via a crafted URL...

Code injection

EMC Avamar Client before 6.1.101-89 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Code injection

The nsrpush process in the client in EMC NetWorker before 7.6.5.3 and 8.x before 8.0.1.4 sets weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors...

CVE-2013-0944

CVE-2013-0944 affects EMC Avamar Server prior to 6.1.0. The issue resides in the web-based file-restore interface, allowing remote authenticated users to read arbitrary files via a crafted URL. Red Hat and EMC advisories corroborate the vulnerability and provide a remediation path: upgrade to EMC...

CVE-2013-0940

The nsrpush process in the client in EMC NetWorker before 7.6.5.3 and 8.x before 8.0.1.4 sets weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors...

CVE-2013-0945

The CVE-2013-0945 entry concerns EMC Avamar Client prior to 6.1.101-89, where the client does not verify that the server hostname matches the domain name in the server certificate’s CN or SAN. This improper certificate validation allows MITM attackers to spoof SSL servers using an arbitrary valid...

CVE-2013-0944

The web-based file-restore interface in EMC Avamar Server before 6.1.0 allows remote authenticated users to read arbitrary files via a crafted URL...

CVE-2013-0940

Summary: CVE-2013-0940 affects the EMC NetWorker client’s nsrpush process. Affected versions: before 7.6.5.3 and 8.x before 8.0.1.4. Root cause: the nsrpush process sets weak permissions on unspecified files, enabling local privilege escalation (via unspecified/unknown vectors). Impact (as stated...

CVE-2013-0945

EMC Avamar Client before 6.1.101-89 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...