CVSS: 9.8EPSS: 7%CPEs: 22EXPL: 1CVE-2017-4914 – VMware vSphere Data Protection 5.x/6.x - Java Deserialization
https://notcve.org/view.php?id=CVE-2017-4914
VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance. VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, y 5.5.x contiene un problema de deserialización que permitiría a un atacante remoto ejecutar comandos en el aparato. • https://www.exploit-db.com/exploits/42152 http://www.securityfocus.com/bid/98939 http://www.securitytracker.com/id/1038617 http://www.vmware.com/security/advisories/VMSA-2017-0010.html • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 8%CPEs: 22EXPL: 0CVE-2016-7456 – VMware VDP Known SSH Key
https://notcve.org/view.php?id=CVE-2016-7456
VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session. VMware vSphere Data Protection (VDP) 5.5.x hasta la versión 6.1.x tiene una clave privada SSH con una contraseña públicamente conocida, lo que hace más fácil a atacantes remotos obtener acceso de inicio de sesión a través de una sesión SSH. VMware vSphere Data Protection appliances 5.5.x through 6.1.x contain a known ssh private key for the local user admin who is a sudoer without password. • http://www.securityfocus.com/bid/94990 http://www.securitytracker.com/id/1037502 http://www.vmware.com/security/advisories/VMSA-2016-0024.html • CWE-255: Credentials Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2014-4632
https://notcve.org/view.php?id=CVE-2014-4632
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certificate. vSphere Data Protection (VDP) versión 5.1, versiones 5.5 anteriores a 5.5.9 y versiones 5.8 anteriores a 5.8.1 de VMware y el cliente proxy en Avamar Data Store (ADS) y Avamar Virtual Edition (AVE) versiones 6.x y 7.0.x de EMC, no comprueba apropiadamente los certificados X.509 de los servidores SSL de vCenter Server, lo que permite atacantes de tipo man-in-the-middle falsificar servidores, y omitir las restricciones de acceso de copia de seguridad y restauración previstas, por medio de un certificado diseñado. • http://archives.neohapsis.com/archives/bugtraq/2015-01/0154.html http://www.securitytracker.com/id/1031664 http://www.vmware.com/security/advisories/VMSA-2015-0002.html https://exchange.xforce.ibmcloud.com/vulnerabilities/100866 • CWE-310: Cryptographic Issues •