CVSS: 10.0EPSS: 0%CPEs: 11EXPL: 0CVE-2019-18780
https://notcve.org/view.php?id=CVE-2019-18780
An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows. Una vulnerabilidad de inyección de comandos arbitraria en el componente Cluster Server de Veritas InfoScale, permite a un atacante remoto no autenticado ejecutar comandos arbitrarios como root o administrador. Estos productos de Veritas están afectados: Access versión 7.4.2 y anteriores, Access Appliance versión 7.4.2 y anteriores, Flex Appliance versión 1.2 y anteriores, InfoScale versión 7.3.1 y anteriores, InfoScale versiones entre 7.4.0 y 7.4.1, Veritas Cluster Server (VCS) versión 6.2.1 y anteriores en Linux/UNIX, Veritas Cluster Server (VCS) versión 6.1 y anteriores en Windows, Storage Foundation HA (SFHA) versión 6.2.1 y anteriores en Linux/UNIX y Storage Foundation HA (SFHA) versión 6.1 y anteriores en Windows. • https://www.veritas.com/content/support/en_US/security/VTS19-003 https://www.veritas.com/content/support/en_US/security/VTS19-004 https://www.veritas.com/content/support/en_US/security/VTS19-005 https://www.veritas.com/content/support/en_US/security/VTS19-006 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.1EPSS: 1%CPEs: 11EXPL: 0CVE-2019-14418
https://notcve.org/view.php?id=CVE-2019-14418
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a directory traversal vulnerability allows a VRP user with sufficient privileges to overwrite any file in the VRP virtual machine. A malicious VRP user could use this to replace existing files to take control of the VRP virtual machine. Se detectó un problema en Veritas Resiliencia Platform (VRP) anterior a versión 3.4 HF1. Cuando se carga un paquete de aplicaciones, una vulnerabilidad de salto de directorio permite a un usuario de VRP, con privilegios suficientes, sobrescribir cualquier archivo en la máquina virtual de VRP. • http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html http://seclists.org/fulldisclosure/2019/Jul/39 https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2019-14417
https://notcve.org/view.php?id=CVE-2019-14417
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to DNS functionality. Se detectó un problema en Veritas Resiliencia Platform (VRP) anterior a versión 3.4 HF1. Una vulnerabilidad de ejecución de comando arbitraria permite a un usuario VRP malicioso ejecutar comandos con privilegios root dentro de la máquina virtual de VRP, relacionada con la funcionalidad DNS. • http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html http://seclists.org/fulldisclosure/2019/Jul/39 https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue2 •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2019-14416
https://notcve.org/view.php?id=CVE-2019-14416
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to resiliency plans and custom script functionality. Se detectó un problema en Veritas Resiliencia Platform (VRP) anterior a versión 3.4 HF1. Una vulnerabilidad de ejecución de comando arbitraria permite a un usuario VRP malicioso ejecutar comandos con privilegios root dentro de la máquina virtual de VRP, relacionada con las funcionalidades de planes de resiliencia y script personalizado. • http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html http://seclists.org/fulldisclosure/2019/Jul/39 https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue3 •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2019-14415
https://notcve.org/view.php?id=CVE-2019-14415
An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that an attacker has access to. Se detectó un problema en Veritas Resiliencia Platform (VRP) anterior a versión 3.4 HF1. Una vulnerabilidad de tipo cross-site scripting (XSS) persistente permite a un usuario de VRP malicioso inyectar script malicioso en el navegador de otro usuario, relacionada con la funcionalidad de los planes de resiliencia. • http://packetstormsecurity.com/files/153842/Veritas-Resiliency-Platform-VRP-Traversal-Command-Execution.html http://seclists.org/fulldisclosure/2019/Jul/39 https://www.veritas.com/content/support/en_US/security/VTS19-002.html#Issue4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •