CVSS: 8.8EPSS: 0%CPEs: 46EXPL: 1CVE-2018-1434 – IBM Flashsystem / Storwize CSRF / Arbitrary File Read / Information Disclosure
https://notcve.org/view.php?id=CVE-2018-1434
14 May 2018 — IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 139474. Los productos IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize e IBM FlashSystem ( 6.1, 6.2, 6.3, 6.4, 7.1, 7... • https://packetstorm.news/files/id/147601 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 46EXPL: 1CVE-2018-1438 – IBM Flashsystem / Storwize CSRF / Arbitrary File Read / Information Disclosure
https://notcve.org/view.php?id=CVE-2018-1438
14 May 2018 — IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DLSnap could allow an unauthenticated attacker to read arbitrary files on the system. IBM X-Force ID: 139566. En los productos IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize e IBM FlashSystem ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1 y 8.1.1),... • https://packetstorm.news/files/id/147601 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 8EXPL: 0CVE-2017-1710
https://notcve.org/view.php?id=CVE-2017-1710
13 Nov 2017 — A vulnerability in the Service Assistant GUI in IBM Storwize V7000 (2076) 8.1 could allow a remote attacker to perform a privilege escalation. IBM X-Force ID: 134531. Una vulnerabilidad en el Service Assistant GUI en IBM Storwize V7000 (2076) 8.1 podría permitir que un atacante remoto realice un escalado de privilegios. IBM X-Force ID: 134531. • http://www.ibm.com/support/docview.wss?uid=ssg1S1010788 •
CVSS: 10.0EPSS: 89%CPEs: 345EXPL: 23CVE-2014-7169 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-7169
25 Sep 2014 — GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a ... • https://packetstorm.news/files/id/128650 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-228: Improper Handling of Syntactically Invalid Structure •
CVSS: 10.0EPSS: 94%CPEs: 345EXPL: 135CVE-2014-6271 – GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2014-6271
24 Sep 2014 — GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." N... • https://packetstorm.news/files/id/181111 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 58EXPL: 0CVE-2014-4811
https://notcve.org/view.php?id=CVE-2014-4811
12 Sep 2014 — IBM Storwize 3500, 3700, 5000, and 7000 devices and SAN Volume Controller 6.x and 7.x before 7.2.0.8 allow remote attackers to reset the administrator superuser password to its default value via a direct request to the administrative IP address. IBM Storwize 3500, 3700, 5000, y dispositivos 7000 y SAN Volume Controller 6.x y 7.x anterior a 7.2.0.8 permiten a atacantes remotos restablecer la contraseña del superusuario administrador a su valor por defecto a través de una solicitud directa hacia la dirección ... • http://secunia.com/advisories/61075 • CWE-255: Credentials Management Errors •
CVSS: 9.1EPSS: 0%CPEs: 143EXPL: 0CVE-2014-0880
https://notcve.org/view.php?id=CVE-2014-0880
29 Mar 2014 — IBM SAN Volume Controller; Storwize V3500, V3700, V5000, and V7000; and Flex System V7000 with software 6.3 and 6.4 before 6.4.1.8, and 7.1 and 7.2 before 7.2.0.3, allow remote attackers to obtain CLI access, and consequently cause a denial of service, via unspecified traffic to the administrative IP address. IBM SAN Volume Controller; Storwize V3500, V3700, V5000 y V7000; y Flex System V7000 con software 6.3 y 6.4 anterior a 6.4.1.8 y 7.1 y 7.2 anterior a 7.2.0.3, permite a atacantes remotos obtener acceso... • http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004570 •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2012-6354
https://notcve.org/view.php?id=CVE-2012-6354
19 Feb 2013 — The management GUI on the IBM SAN Volume Controller and Storwize V7000 6.x before 6.4.1.3 allows remote attackers to bypass authentication and obtain superuser access via IP packets. La interfaz de gestión en el controlador de volumen SAN IBM Storwize V7000 v6.x antes de v6.4.1.3 permite a atacantes remotos evitar la autenticación y obtener acceso de superusuario a través de paquetes IP. • http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004277 • CWE-287: Improper Authentication •