CVE-2017-8132: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with...

PT-2017-18174

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00SPC102NFV and V100R006C10 Description The issue is related to an information leak due to an incorrect configuration item. This results in unencrypted information being transmitted by a transmission...

CVE-2017-2714: Improper Restriction of Operations within the Bounds of a Memory Buffer

The GaussDB in FusionSphere OpenStack V100R005C10SPC705 and earlier versions has a buffer overflow vulnerability. An authenticated attacker on the LAN can exploit this vulnerability to execute arbitrary code or cause a denial of service DoS condition in the affected system...

CVE-2017-8168: Missing Encryption of Sensitive Data

FusionSphere OpenStack with software V100R006C00SPC102NFV and V100R006C10 have an information leak vulnerability. Due to an incorrect configuration item, the information transmitted by a transmission channel is not encrypted. An attacker accessing the internal network may obtain sensitive...

CVE-2017-8194: Improper Authentication

The FusionSphere OpenStack V100R006C00SPC102NFV has an improper authentication vulnerability. Due to improper authentication on one port, an authenticated, remote attacker may exploit the vulnerability to execute more operations by send a crafted rest message...

CVE-2017-8134: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack with software V100R006C00 and V100R006C10 has a command injection vulnerability due to the insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit the vulnerabilities to gain root privileges by sending some messages with...

PT-2017-15507

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00 Description The software has an information exposure issue due to the use of a hard-coded cryptographic key for encrypting messages between certain components. This significantly increases the risk th...

CVE-2017-2720: Use of Hard-coded Credentials

FusionSphere OpenStack V100R006C00 has an information exposure vulnerability. The software uses hard-coded cryptographic key to encrypt messages between certain components, which significantly increases the possibility that encrypted data may be recovered and results in information exposure...

PT-2017-18194

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00SPC102NFV Description The issue is related to an improper verification of cryptographic signature. Specifically, the software fails to verify the cryptographic signature, which could allow an attacker...

PT-2017-15501

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R005C10SPC705 and earlier Description The issue allows an authenticated attacker on the LAN to exploit a buffer overflow, potentially leading to the execution of arbitrary code or a denial of service DoS...

PT-2017-15505

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10RC2 Description The issue is related to command injection vulnerabilities due to insufficient input validation on one port. An attacker can exploit these vulnerabilities to gain ro...

PT-2017-18143

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10 Description The issue is related to a command injection vulnerability caused by insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit...

PT-2017-15506

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10RC2 Description The issue is related to command injection vulnerabilities caused by insufficient input validation on a specific port. An attacker can exploit this to gain root...

PT-2017-18197

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00SPC102NFV Description The issue is related to a command injection vulnerability due to insufficient input validation on one port. An authenticated, local attacker may exploit this to gain root privileg...

PT-2017-18192

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00SPC102NFV Description The issue is related to a command injection vulnerability due to a lack of validation. This allows an attacker with high privileges to inject malicious code into certain modules o...

PT-2017-18199

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00SPC102NFV Description The issue is related to improper authentication on one port, allowing an authenticated, remote attacker to execute more operations by sending a crafted REST message. Recommendatio...

PT-2017-18196

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack version V100R006C00 Description The issue is related to improper authorization, allowing an attacker with low privilege to potentially exploit it and gain operation authority over specific directories, leading to privile...

PT-2017-18144

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10 Description The issue is related to a command injection vulnerability caused by insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit...

PT-2017-18140

Name of the Vulnerable Software and Affected Versions FusionSphere OpenStack versions V100R006C00 through V100R006C10 Description The issue is related to a command injection vulnerability caused by insufficient input validation on four TCP listening ports. An unauthenticated attacker can exploit...

CVE-2017-8193: Improper Neutralization of Special Elements used in a Command

The FusionSphere OpenStack V100R006C00SPC102NFV has a command injection vulnerability. Due to the insufficient input validation on one port, an authenticated, local attacker may exploit the vulnerability to gain root privileges by sending message with malicious commands...