Directory traversal

In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R Watch4Net for SAS Solution Packs, the Webservice Gateway is affected by a directory traversal vulnerability. Attackers with knowledge of Webservice Gateway credentials could potentially exploit this vulnerability to access unauthorized information, a...

CVE-2017-8007

In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R Watch4Net for SAS Solution Packs, the Webservice Gateway is affected by a directory traversal vulnerability. Attackers with knowledge of Webservice Gateway credentials could potentially exploit this vulnerability to access unauthorized information, a...

CVE-2017-8012

The CVE pertains to Dell EMC/VNX Monitoring and Reporting (RMI Registry) deserialization vulnerability that can be exploited remotely to cause a DoS. The attack path involves the exposed RMI registry (default port 52569) accepting untrusted data; authentication exists but can be bypassed per the ...

USN-3414-1 qemu vulnerabilities

Leo Gaspard discovered that QEMU incorrectly handled VirtFS access control. A guest attacker could use this issue to elevate privileges inside the guest. CVE-2017-7493 Li Qiang discovered that QEMU incorrectly handled VMWare PVSCSI emulation. A privileged attacker inside the guest could use this...

sas-agri.com XSS vulnerability

Open Bug Bounty ID: OBB-284293 Description| Value ---|--- Affected Website:| sas-agri.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-8011

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...

CVE-2017-8011

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...

CVE-2017-8011

CVE-2017-8011 is substantiated by connected disclosures indicating default/undocumented accounts with passwords in EMC/VNX monitoring products, enabling remote execution when the Webservice Gateway/RMI JMX are targeted. ZDI-17-505 details a remote code execution path via static credentials in the...

CVE-2017-8011

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...

QEMU 'megasas command handling' denial of service vulnerability

QEMU is an open source emulator software. QEMU supports MegaRAID SAS 8708EM2 Host Bus Adapter emulation suffers from a security vulnerability that allows local attackers to exploit the vulnerability by submitting a specially crafted request that triggers memory corruption and crashes the...

CVE-2017-9503

QEMU aka Quick Emulator, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash via vectors involving megasas command processing...

CVE-2017-9503

QEMU aka Quick Emulator, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash via vectors involving megasas command processing...

DEBIAN-CVE-2017-9503

QEMU aka Quick Emulator, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash via vectors involving megasas command processing...

Null pointer dereference

QEMU aka Quick Emulator, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash via vectors involving megasas command processing...

CVE-2017-9503

Technical details about CVE-2017-9503 are not publicly provided in the connected documents. Please monitor for updates.

CVE-2017-9503

QEMU aka Quick Emulator, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash via vectors involving megasas command processing...

CVE-2017-9503

QEMU aka Quick Emulator, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service NULL pointer dereference and QEMU process crash via vectors involving megasas command processing...

DEBIAN-CVE-2015-8613

Stack-based buffer overflow in the megasasctrlgetinfo function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service QEMU instance crash via a crafted SCSI controller CTRLGETINFO command...

CVE-2015-8613

CVE-2015-8613 is a stack-based buffer overflow in QEMU’s megasas_ctrl_get_info when using SCSI MegaRAID SAS HBA emulation, allowing local guest users to crash the QEMU process (DoS) via a crafted CTRL_GET_INFO SCSI command. The vulnerability affects QEMU’s SCSI MegaRAID SAS HBA emulation and has ...

On SAS 2017, the Microsoft IIS Zero Day, and Mirai

Mike Mimoso and Chris Brook preview this year’s Security Analyst Summit and discuss the news of the week, including a Microsoft IIS zero day, a new Mirai variant, and the broadband privacy ruling. Download: ThreatpostNewsWrapMarch312017.mp3 Music by Chris Gonsalves...