VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

1. Impacted Products VMware Horizon VMware vCenter Server VMware HCX VMware NSX-T Data Center VMware Unified Access Gateway VMware WorkspaceOne Access VMware Identity Manager VMware vRealize Operations VMware vRealize Operations Cloud Cloud Proxy VMware vRealize Automation VMware vRealize...

ManageEngine Network Configuration Manager 12.2 - apiKey SQL Injection

ManageEngine Network Configuration Manager 12.2 - apiKey SQL Injection Exploit Title: ManageEngine Network Configuration Manager 12.2 - 'apiKey' SQL Injection discovery Date: 2019-01-24 published : 2020-01-20 Exploit Author: AmirHadi Yazdani Vendor Homepage:...

CVE-2017-8017

EMC Network Configuration Manager (NCM) is affected by a reflected cross-site scripting vulnerability (CVE-2017-8017) in multiple releases: 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x. The issue is described as a reflected XSS that could enable a malicious actor to compromise the affected system. The li...

CVE-2017-8017

EMC Network Configuration Manager NCM 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x is affected by a reflected cross-site scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system...

CVE-2017-2768

EMC Network Configuration Manager NCM 9.3.x, EMC Network Configuration Manager NCM 9.4.0.x, EMC Network Configuration Manager NCM 9.4.1.x, EMC Network Configuration Manager NCM 9.4.2.x contains an Improper Authentication vulnerability that could potentially be exploited by malicious users to...

Authentication flaw

EMC Network Configuration Manager NCM 9.3.x, EMC Network Configuration Manager NCM 9.4.0.x, EMC Network Configuration Manager NCM 9.4.1.x, EMC Network Configuration Manager NCM 9.4.2.x contains an Improper Authentication vulnerability that could potentially be exploited by malicious users to...

CVE-2017-2767

EMC Network Configuration Manager (NCM) versions 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x are associated with a Java RMI remote code execution vulnerability. The connected CNVD/NVD records describe a remote code execution flaw that could allow a malicious attacker to take control of an affected syste...

CVE-2017-2768

EMC Network Configuration Manager (NCM) versions 9.3.x, 9.4.0.x, 9.4.1.x and 9.4.2.x contain an Improper Authentication vulnerability for CVE-2017-2768 that could allow a malicious user to compromise the affected system. The connected sources identify a high-severity, network-exposed issue (CVSSv...

CVE-2017-2767

EMC Network Configuration Manager NCM 9.3.x, EMC Network Configuration Manager NCM 9.4.0.x, EMC Network Configuration Manager NCM 9.4.1.x, EMC Network Configuration Manager NCM 9.4.2.x contains a Java RMI Remote Code Execution vulnerability that could potentially be exploited by malicious users t...

Manage Engine Network Configuration Manager Build 11000 - Cross-Site Request Forgery

Manage Engine Network Configuration Manager Build 11000 - Cross-Site Request Forgery ========================================================================================= Cross-Site Request Forgery Vulnerability in ManageEngine Network Configuration Management...

CVE-2014-9566

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor NPM before 11.5, NetFlow Traffic Analyzer NTA before 4.1, Network Configuration Manager NCM before 7.3.2, IP...

CVE-2014-9566

CVE-2014-9566 : SolarWinds Orion Platform is affected by multiple SQL injection vulnerabilities in the AccountManagement.asmx endpoints (GetAccounts, GetAccountGroups). The issue allows remote authenticated users to execute arbitrary SQL commands by supplying crafted dir or sort parameters. Affec...

SolarWinds Network Configuration Manager (NCM) < 7.3.2 Multiple SQLi Vulnerabilities

SolarWinds Network Configuration Manager NCM is prone to multiple SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

SolarWinds Orion Service - SQL Injection

SolarWinds Orion Service - SQL Injection I found a couple SQL injection vulnerabilities in the core Orion service used in most of the Solarwinds products SAM, IPAM, NPM, NCM, etc…. This service provides a consistent configuration and authentication layer across the products. To be exact, the...

ESA-2014-055: EMC Network Configuration Manager &#40;NCM&#41; Report Advisor Session Fixation Vulnerability

ESA-2014-055.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-055: EMC Network Configuration Manager NCM Report Advisor Session Fixation Vulnerability EMC Identifier: ESA-2014-055 CVE Identifier: CVE-2014-2509 Severity Rating: CVSS v2 Base Score: 6.9 AV:A/AC:M/Au:N/C:C/I:P/A:P Affected...

CVE-2014-3459

Heap-based buffer overflow in SolarWinds Network Configuration Manager NCM before 7.3 allows remote attackers to execute arbitrary code via the PEstrarg1 property...

CVE-2014-3459

The CVE-2014-3459 issue affects SolarWinds Network Configuration Manager (NCM) prior to version 7.3, where a heap-based buffer overflow in the PEstrarg1 property can be exploited to execute arbitrary code. The root cause is a failure to validate the input size before copying into a fixed-size hea...

NCM Content Management System content.pl Input Validation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2584/info The NCM Content Management System is a product distributed by NCM. The NCM Content Management System is designed to manage web material and other data, and provide an interface to databases from web resources. A...

CVE-2014-2509

CVE-2014-2509 describes a session-fixation vulnerability in the EMC Network Configuration Manager (NCM) , specifically within the Report Advisor (RA) component. The issue would allow an attacker to hijack a NCM web session by manipulating the session cookie, affecting the RA prior to version 9.3 ...

ESA-2013-016: EMC Smarts Network Configuration Manager

ESA-2013-016.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2013-016: EMC Smarts Network Configuration Manager Improper Authentication Vulnerability EMC Identifier: ESA-2013-016 CVE Identifier: CVE-2013-0935 Severity Rating: CVSS v2 Base Score: 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C Affected...