CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2017-8007 – Dell EMC VNX Monitoring and Reporting Scheduler Directory Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8007
In EMC ViPR SRM, Storage M&R, VNX M&R, and M&R (Watch4Net) for SAS Solution Packs, the Webservice Gateway is affected by a directory traversal vulnerability. Attackers with knowledge of Webservice Gateway credentials could potentially exploit this vulnerability to access unauthorized information, and modify or delete data, by supplying specially crafted strings in input parameters of the web service call. En EMC ViPR SRM, Storage MR, VNX MR y MR (Watch4Net) para SAS Solution Packs, la puerta de enlace del servicio web se ha visto afectado por una vulnerabilidad de salto de directorio. Los atacantes que conozcan las credenciales de la puerta de enlace del servicio web podrían explotar esta vulnerabilidad para acceder a información no autorizada y modificar o borrar datos proporcionando strings especialmente manipuladas en parámetros de entrada de la llamada del servicio web. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell EMC VNX Monitoring and Reporting. • http://seclists.org/fulldisclosure/2017/Sep/51 http://www.securityfocus.com/bid/100957 http://www.securitytracker.com/id/1039417 http://www.securitytracker.com/id/1039418 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 8%CPEs: 1EXPL: 0CVE-2017-10949 – Dell Storage Manager EmWebsiteServlet Directory Traversal Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-10949
Directory Traversal in Dell Storage Manager 2016 R2.1 causes Information Disclosure when the doGet method of the EmWebsiteServlet class doesn't properly validate user provided path before using it in file operations. Was ZDI-CAN-4459. Una vulnerabilidad de salto de directorio en Dell Storage Manager 2016 R2.1 da lugar a una divulgación de información cuando el método doGet de la clase EmWebsiteServlet no valida correctamente la ruta ofrecida por el usuario y la utiliza en operaciones de archivos. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Dell Storage Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the doGet method of the EmWebsiteServlet class, which listens on TCP port 3033 by default. • http://topics-cdn.dell.com/pdf/dell-compellent-sc8000_release%20notes24_en-us.pdf http://www.securityfocus.com/bid/100138 http://www.zerodayinitiative.com/advisories/ZDI-17-523 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2017-8011 – Dell EMC VNX Monitoring and Reporting Scheduler Static Credentials Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-8011
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system. EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R para SAS Solution Packs (EMC ViPR SRM anterior a versión 4.1, EMC Storage M&R anterior a versión 4.1, EMC VNX M&R todas las versiones, EMC M&R (Watch4Net) para todas las versiones de SAS Solution Packs), contienen cuentas no documentadas con contraseñas por defecto para los componentes WebService Gateway y RMI JMX. Un atacante remoto con conocimiento de la contraseña por defecto puede usar estas cuentas para ejecutar servicios web arbitrarios y llamadas a procedimientos remotos sobre el sistema afectado. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Dell EMC VNX Monitoring and Reporting. • http://seclists.org/fulldisclosure/2017/Jul/21 http://www.securityfocus.com/bid/99555 http://www.securitytracker.com/id/1038905 • CWE-798: Use of Hard-coded Credentials •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2017-4997 – EMC VMAX3 VASA Provider UploadConfigurator Unrestricted File Upload Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-4997
EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system. Las versiones 8.3.x y anteriores de EMC VASA Provider Virtual Appliance contienen una vulnerabilidad de ejecución remota de código no autenticado que podría ser explotada por usuarios maliciosos con el fin de comprometer el sistema afectado. This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of EMC VMAX3 VASA Provider. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UploadConfigurator servlet, which listens on TCP port 5480 by default. The issue results from the web service serving files that have been uploaded by a user. • http://www.securityfocus.com/archive/1/540783/30/0/threaded http://www.securityfocus.com/bid/99169 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-4981
https://notcve.org/view.php?id=CVE-2017-4981
EMC RSA BSAFE Cert-C before 2.9.0.5 contains a potential improper certificate processing vulnerability. RSA BSAFE Cert-C anterior a versión 2.9.0.5 de EMC, contiene una potencial vulnerabilidad de procesamiento inapropiado de certificado. • http://www.securityfocus.com/archive/1/540720/30/0/threaded http://www.securityfocus.com/bid/99044 http://www.securitytracker.com/id/1038695 • CWE-295: Improper Certificate Validation •