CVE-2015-0524: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition ESRS VE 3.02 and 3.03 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-0525: Improper Neutralization of Special Elements used in an OS Command

The Gateway Provisioning service in EMC Secure Remote Services Virtual Edition ESRS VE 3.02 and 3.03 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

PT-2015-4689

Name of the Vulnerable Software and Affected Versions EMC Secure Remote Services Virtual Edition ESRS VE versions 3.02 through 3.03 Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For versions 3.02 and 3.03, at the moment, there is no information...

PT-2015-3763

Name of the Vulnerable Software and Affected Versions VMware vSphere Data Protection VDP versions 5.1, 5.5 through 5.5.8, 5.8 through 5.8.0 EMC Avamar Data Store ADS versions 6.x EMC Avamar Virtual Edition AVE versions 6.x, 7.0.x Description The issue allows man-in-the-middle attackers to spoof...

CVE-2014-4632: Undefined Security Weakness

VMware vSphere Data Protection VDP 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store ADS and Avamar Virtual Edition AVE 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoo...

CVE-2014-4623

EMC Avamar ADS GEN4(S) and Avamar Virtual Edition (AVE) versions 6.0.x, 6.1.x, and 7.0.x are affected when the Password Hardening package is installed prior to 2.0.0.4. The issue stems from using UNIX DES crypt for password hashing, enabling context-dependent attackers to recover cleartext passwo...

CVE-2014-4624

EMC Avamar Data Store ADS and Avamar Virtual Edition AVE 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call...

CVE-2014-4624

EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x up to 7.0.2-43 expose MCUser and GSAN passwords via Java API calls without authentication (remote information disclosure). VMware vSphere Data Protection (VDP) 5.x also vulnerable via Java API access to retrieve credential...

CVE-2014-4624: Undefined Security Weakness

EMC Avamar Data Store ADS and Avamar Virtual Edition AVE 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call...

PT-2014-6031

Name of the Vulnerable Software and Affected Versions EMC Avamar Data Store ADS and Avamar Virtual Edition AVE versions 6.x and 7.0.x through 7.0.2-43 Description The issue allows remote attackers to discover grid MCUser and GSAN passwords via a crafted Java API call, as no authentication is...

CVE-2014-4623: Undefined Security Weakness

EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store ADS GEN4S and Avamar Virtual Edition AVE, when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force atta...

F5 Networks BIG-IP : SSH vulnerability (K13600)

A platform-specific remote access vulnerability has been discovered that may allow a remote user to gain privileged access to affected systems using secure shell SSH. The vulnerability is caused by a configuration error, and is not the result of an underlying SSH defect. The following platforms a...

Security Gateway Virtual Edition (VE) VMWare OVF template security update

...

CVE-2013-3275

EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly restrict use of FRAME elements, which makes it easier for remote attackers to obtain sensitive information via a crafted web site, related to "cross frame scripting vulnerabilitie...

CVE-2013-3274

EMC Avamar Server and Avamar Virtual Edition before version 7.0 on Data Store Gen3, Gen4, and Gen4s hardware are affected by CVE-2013-3274 due to improper authorization checks on Java RMI calls. This potentially allows remote authenticated users to execute arbitrary code via unspecified vectors. ...

CVE-2013-3274: Undefined Security Weakness

EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly determine authorization for calls to Java RMI methods, which allows remote authenticated users to execute arbitrary code via unspecified vectors...

CVE-2013-3275: Improper Input Validation

EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3, Gen4, and Gen4s platforms do not properly restrict use of FRAME elements, which makes it easier for remote attackers to obtain sensitive information via a crafted web site, related to "cross frame scripting vulnerabilitie...

PT-2013-4271

Name of the Vulnerable Software and Affected Versions EMC Avamar Server and Avamar Virtual Edition versions prior to 7.0 Description The issue makes it easier for remote attackers to obtain sensitive information via a crafted web site, related to cross frame scripting vulnerabilities, due to the...

CVE-2012-2285: Improper Authentication

EMC Cloud Tiering Appliance aka CTA, formerly FMA 9.0 and earlier, and Cloud Tiering Appliance Virtual Edition CTA/VE 9.0 and earlier, allows remote attackers to obtain GUI administrative access by sending a crafted file during the authentication phase...

PT-2012-3924

Name of the Vulnerable Software and Affected Versions EMC Cloud Tiering Appliance versions 9.0 and earlier EMC Cloud Tiering Appliance Virtual Edition versions 9.0 and earlier Description The issue allows remote attackers to obtain GUI administrative access by sending a crafted file during the...