CVSS: 9.8EPSS: 7%CPEs: 22EXPL: 1CVE-2017-4914 – VMware vSphere Data Protection 5.x/6.x - Java Deserialization
https://notcve.org/view.php?id=CVE-2017-4914
VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, and 5.5.x contains a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance. VMware vSphere Data Protection (VDP) 6.1.x, 6.0.x, 5.8.x, y 5.5.x contiene un problema de deserialización que permitiría a un atacante remoto ejecutar comandos en el aparato. • https://www.exploit-db.com/exploits/42152 http://www.securityfocus.com/bid/98939 http://www.securitytracker.com/id/1038617 http://www.vmware.com/security/advisories/VMSA-2017-0010.html • CWE-502: Deserialization of Untrusted Data •
CVSS: 10.0EPSS: 8%CPEs: 22EXPL: 0CVE-2016-7456 – VMware VDP Known SSH Key
https://notcve.org/view.php?id=CVE-2016-7456
VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session. VMware vSphere Data Protection (VDP) 5.5.x hasta la versión 6.1.x tiene una clave privada SSH con una contraseña públicamente conocida, lo que hace más fácil a atacantes remotos obtener acceso de inicio de sesión a través de una sesión SSH. VMware vSphere Data Protection appliances 5.5.x through 6.1.x contain a known ssh private key for the local user admin who is a sudoer without password. • http://www.securityfocus.com/bid/94990 http://www.securitytracker.com/id/1037502 http://www.vmware.com/security/advisories/VMSA-2016-0024.html • CWE-255: Credentials Management Errors •