CVE-2017-8007

In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R Watch4Net for SAS Solution Packs, the Webservice Gateway is affected by a directory traversal vulnerability. Attackers with knowledge of Webservice Gateway credentials could potentially exploit this vulnerability to access unauthorized information, a...

Webservice Gateway Directory Traversal Vulnerability in Multiple EMC Products

EMC ViPR SRM and others are products of EMC Corporation.EMC ViPR SRM is a suite of storage resource management software.Storage M&R is a data storage collector.Webservice Gateway is one of the gateways. A directory traversal vulnerability exists in Webservice Gateway in multiple EMC products. A...

The vulnerabilities of the components of Webservice Gateway and RMI JMX software solutions for monitoring, visualization, analysis, and optimization of storage resources in EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, and EMC M&R SAS Solution Packs allow attackers to launch arbitrary web services and trigger certain procedures.

The vulnerability of the components of Webservice Gateway and RMI JMX software solutions for monitoring, visualization, analysis, and optimization of storage resources for EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, and EMC M&R for SAS Solution Packs is related to the use of fixed system accounts...

Dell EMC VNX Monitoring and Reporting Scheduler Static Credentials Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell EMC VNX Monitoring and Reporting. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...

CVE-2017-8011

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...

CVE-2017-8011

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...

CVE-2017-8011

CVE-2017-8011 is substantiated by connected disclosures indicating default/undocumented accounts with passwords in EMC/VNX monitoring products, enabling remote execution when the Webservice Gateway/RMI JMX are targeted. ZDI-17-505 details a remote code execution path via static credentials in the...

SQL Injection Vulnerability in Webservice of Wando ezOFFICE Collaboration Office System

Wando ezOFFICE collaborative management platform is a comprehensive information base application platform. A SQL injection vulnerability exists in the Wando ezOFFICE Collaborative Office System webservice. The lack of filtering of the 'SOAP unitLevel' parameter allows attackers to exploit the...

Pan micro-OA system webservice-xml/login/login. wsdl. php blind

No description provided by source...

万户OA xfire xml实体注入漏洞

xfire xml实体注入 webservice使用了xfire框架，存在xxe漏洞 jmx-console 存在默认口令: admin/ezoffice，网上搜一下基本没改。...

万户OA webservice SQL 注入漏洞

0x3 SQL注射 webservice服务需要一个通信密码，但官方自己留了一个万能密码：auth.key.whir2012 有了这个key，webservice都能使用。可以进行添加、删除用户等操作。 webservice很多地方没有使用参数查询还是拼接sql，存在SQL注射：...

泛微oa /webservice/upload.php /webservice/upload/upload.php 等多处任意文件上传

任意文件上传共四处，属于同一个漏洞 文件位置 /webservice/upload.php /webservice/upload/upload.php /webservice-json/upload/upload.php /webservice-xml/upload/upload.php 四处都有如下代码 没有对文件有任何验证，无须登陆 文件上传之后的位置是： $path = $ATTACHPATH.$attachmentID; $fileName = $path."/".$FILES'file''name'; moveuploadedfile $FILES'file''tmpname'...

GPS satellite positioning platform vulnerability disaster, the user location information in an emergency-vulnerability warning-the black bar safety net

Recently, the press exposure a lot of plays through the GPS positioning device trace abduction. By on the market on some of the GPS positioning device research, found that these GPS positioning system background using a common set of procedures, its Cloud Platform on the presence of multiple...

Webservice-DIC yoyaku_v41 OS Command Injection Vulnerability

Webservice-DIC yoyakuv41 is a conference room reservation management software from Webservice-DIC. Webservice-DIC yoyakuv41 fails to properly filter user-submitted input, allowing remote attackers to exploit the vulnerability by submitting a special request to execute arbitrary operating system...

Webservice-DIC yoyaku_v41 Input Validation Vulnerability

Webservice-DIC yoyakuv41 is a conference room reservation management software from Webservice-DIC. Webservice-DIC yoyakuv41 fails to properly filter user-submitted input, allowing remote attackers to exploit the vulnerability by submitting a special request to create arbitrary files...

CVE-2015-2979

Webservice-DIC yoyakuv41 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2015-2978

Webservice-DIC yoyakuv41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."...

Code injection

Webservice-DIC yoyakuv41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors...

CVE-2015-2977

Webservice-DIC yoyakuv41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors...

Authentication flaw

Webservice-DIC yoyakuv41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."...