PT-2017-15507

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00 Description The software has an information exposure issue due to the use of a hard-coded cryptographic key for encrypting messages between certain components. This significantly increases the risk th...

PT-2017-15505

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10RC2 Description The issue is related to command injection vulnerabilities due to insufficient input validation on one port. An attacker can exploit these vulnerabilities to gain ro...

PT-2017-18144

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10 Description The issue is related to a command injection vulnerability caused by insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit...

PT-2017-18197

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00SPC102NFV Description The issue is related to a command injection vulnerability due to insufficient input validation on one port. An authenticated, local attacker may exploit this to gain root privileg...

PT-2017-18141

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10 Description The issue is related to a command injection vulnerability caused by insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit...

CVE-2017-8198: Improper Neutralization of Special Elements used in an SQL Command

FusionSphere V100R006C00SPC102NFV has an SQL injection vulnerability. An authenticated, remote attacker could craft interface messages carrying malicious SQL statements and send them to a target device. Successful exploit could allow the attacker to launch an SQL injection attack and execute SQL...

CVE-2017-8195: Improper Authentication

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

CVE-2017-8193: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack V100R006C00SPC102NFV has a command injection vulnerability. Due to the insufficient input validation on one port, an authenticated, local attacker may exploit the vulnerability to gain root privileges by sending message with malicious commands...

CVE-2017-8168: Missing Encryption of Sensitive Data

FusionSphere OpenStack with software V100R006C00SPC102NFV and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive...

CVE-2017-8134: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with...

CVE-2017-8191: Use of a Broken or Risky Cryptographic Algorithm

FusionSphere OpenStack V100R006C00SPC102NFVhas a week cryptographic algorithm vulnerability. Attackers may exploit the vulnerability to crack the cipher text and cause information leak on the transmission links...

CVE-2017-8189: Improper Limitation of a Pathname to a Restricted Directory

FusionSphere OpenStack V100R006C00SPC102NFVhas a path traversal vulnerability. Due to insufficient path validation, an attacker with high privilege may exploit this vulnerability to cover some files, causing services abnormal...

CVE-2017-8135: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with...

CVE-2017-8132: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with...

PT-2017-18192

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00SPC102NFV Description The issue is related to a command injection vulnerability due to a lack of validation. This allows an attacker with high privileges to inject malicious code into certain modules o...

PT-2017-18202

Name of the Vulnerable Software and Affected Versions FusionSphere V100R006C00SPC102NFV Description The issue allows an authenticated, remote attacker to craft interface messages carrying malicious SQL statements and send them to a target device. Successful exploitation could enable the attacker ...

CVE-2017-8131: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with...

CVE-2017-8192: Incorrect Authorization

FusionSphere OpenStack V100R006C00 has an improper authorization vulnerability. Due to improper authorization, an attacker with low privilege may exploit this vulnerability to obtain the operation authority of some specific directory, causing privilege escalation...

PT-2017-18201

Name of the Vulnerable Software and Affected Versions FusionSphere V100R006C00SPC102NFV Description The issue allows an authenticated, remote attacker to craft packets with malicious strings and send them to a target device. Successful exploitation could enable the attacker to launch a command...

PT-2017-15501

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R005C10SPC705 and earlier Description The issue allows an authenticated attacker on the LAN to exploit a buffer overflow, potentially leading to the execution of arbitrary code or a denial of service DoS...