CVSS: 9.0EPSS: 0%CPEs: 18EXPL: 0CVE-2017-15550
https://notcve.org/view.php?id=CVE-2017-15550
An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could access arbitrary files on the server file system in the context of the running vulnerable application via Path traversal. Se ha descubierto un problema en EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x y EMC Integrated Data Protection Appliance 2.0. Un usuario autenticado remoto malicioso con bajos privilegios podría acceder a archivos arbitrarios en el sistema de archivos del servidor en el contexto de la aplicación vulnerable en ejecución mediante un salto de directorio. • http://seclists.org/fulldisclosure/2018/Jan/17 http://www.securityfocus.com/bid/102358 http://www.securitytracker.com/id/1040070 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.1EPSS: 0%CPEs: 25EXPL: 0CVE-2017-8022
https://notcve.org/view.php?id=CVE-2017-8022
An issue was discovered in EMC NetWorker (prior to 8.2.4.9, all supported 9.0.x versions, prior to 9.1.1.3, prior to 9.2.0.4). The Server service (nsrd) is affected by a buffer overflow vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to execute arbitrary code on vulnerable installations of the software, or cause a denial of service, depending on the target system's platform. Se ha descubierto un problema en EMC NetWorker (versiones anteriores a la 8.2.4.9, todas las versiones 9.0.x con soporte, las anteriores a la 9.1.1.3 y las anteriores a la 9.2.0.4). El servicio Server (nsrd) se ha visto afectado por una vulnerabilidad de desbordamiento de búfer. • http://seclists.org/fulldisclosure/2017/Oct/35 http://www.securitytracker.com/id/1039583 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 32EXPL: 0CVE-2015-0530
https://notcve.org/view.php?id=CVE-2015-0530
Buffer overflow in an unspecified function in nsr_render_log in EMC NetWorker before 8.0.4.3, 8.1.x before 8.1.2.6, and 8.2.x before 8.2.1.2 allows local users to gain privileges via unknown vectors. Desbordamiento de buffer en una función no especificada en nsr_render_log en EMC NetWorker anterior a 8.0.4.3, 8.1.x anterior a 8.1.2.6, y 8.2.x anterior a 8.2.1.2 permite a usuarios locales ganar privilegios a través de vectores desconocidos. • http://seclists.org/bugtraq/2015/Apr/103 http://www.securitytracker.com/id/1032147 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 70EXPL: 0CVE-2013-0940
https://notcve.org/view.php?id=CVE-2013-0940
The nsrpush process in the client in EMC NetWorker before 7.6.5.3 and 8.x before 8.0.1.4 sets weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors. El proceso nsrpush en el cliente en EMC NetWorker anterior a v7.6.5.3 y v8.x anterior a v8.0.1.4 fija permisos débiles para ficheros no especificados, permitiendo a usuarios locales ganar privilegios mediante vectores desconocidos. • http://archives.neohapsis.com/archives/bugtraq/2013-05/0013.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 94%CPEs: 53EXPL: 0CVE-2012-4607 – EMC NetWorker nsrck.exe Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-4607
Buffer overflow in nsrindexd in EMC NetWorker 7.5.x and 7.6.x before 7.6.5, and 8.x before 8.0.0.6, allows remote attackers to execute arbitrary code via crafted SunRPC data. Un desbordamiento de búfer en nsrindexd en EMC NetWorker v7.5.x y v7.6.x antes de v7.6.5 y v8.x antes de v8.0.0.6, permite a atacantes remotos ejecutar código de su elección a través de datos SunRPC hechos a mano. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC NetWorker. Authentication is not required to exploit this vulnerability. The specific flaw exists within the way nsrck.exe handles a remotely supplied string. When handling RPC calls for opcode 0x07 of program 0x0005F3D9, the nsrindexd.exe process starts a new nsrck.exe process using a user-supplied string parameter as a command argument. • http://archives.neohapsis.com/archives/bugtraq/2013-01/0029.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •