CVSS: 4.6EPSS: 0%CPEs: 43EXPL: 0CVE-2013-0943
https://notcve.org/view.php?id=CVE-2013-0943
EMC NetWorker 7.6.x and 8.x before 8.1 allows local users to obtain sensitive configuration information by leveraging operating-system privileges to perform decryption with nsradmin. EMC NetWorker 7.6.x y 8.x anterior a 8.1, permite a usuarios locales obtener información sensible de la configuración aprovechando los privilegios del sistema operativo para realizar un descifrado con nsradmin. • http://archives.neohapsis.com/archives/bugtraq/2013-07/0193.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 70EXPL: 0CVE-2013-0940
https://notcve.org/view.php?id=CVE-2013-0940
The nsrpush process in the client in EMC NetWorker before 7.6.5.3 and 8.x before 8.0.1.4 sets weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors. El proceso nsrpush en el cliente en EMC NetWorker anterior a v7.6.5.3 y v8.x anterior a v8.0.1.4 fija permisos débiles para ficheros no especificados, permitiendo a usuarios locales ganar privilegios mediante vectores desconocidos. • http://archives.neohapsis.com/archives/bugtraq/2013-05/0013.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 94%CPEs: 53EXPL: 0CVE-2012-4607 – EMC NetWorker nsrck.exe Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-4607
Buffer overflow in nsrindexd in EMC NetWorker 7.5.x and 7.6.x before 7.6.5, and 8.x before 8.0.0.6, allows remote attackers to execute arbitrary code via crafted SunRPC data. Un desbordamiento de búfer en nsrindexd en EMC NetWorker v7.5.x y v7.6.x antes de v7.6.5 y v8.x antes de v8.0.0.6, permite a atacantes remotos ejecutar código de su elección a través de datos SunRPC hechos a mano. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC NetWorker. Authentication is not required to exploit this vulnerability. The specific flaw exists within the way nsrck.exe handles a remotely supplied string. When handling RPC calls for opcode 0x07 of program 0x0005F3D9, the nsrindexd.exe process starts a new nsrck.exe process using a user-supplied string parameter as a command argument. • http://archives.neohapsis.com/archives/bugtraq/2013-01/0029.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0CVE-2012-2284
https://notcve.org/view.php?id=CVE-2012-2284
The (1) install and (2) upgrade processes in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1, 2.3 before build 122, and 2.4 before build 375, when Exchange Server is used, allow local users to read cleartext administrator credentials via unspecified vectors. El proceso del (1) instalación and (2) actualización en EMC NetWorker Module para Microsoft Applications (NMM) v2.2.1, v2.3 anterior al build v122, y v2.4 anterior al build v375, cuando el Exchange Server es usado, permite a usuarios locales leer las credenciales del administrador en texto plano mediante vectores desconocidos vectors. • http://archives.neohapsis.com/archives/bugtraq/2012-10/0068.html http://osvdb.org/86157 http://secunia.com/advisories/50957 http://www.securityfocus.com/bid/55883 http://www.securitytracker.com/id?1027647 • CWE-255: Credentials Management Errors •
CVSS: 9.3EPSS: 6%CPEs: 3EXPL: 0CVE-2012-2290
https://notcve.org/view.php?id=CVE-2012-2290
The client in EMC NetWorker Module for Microsoft Applications (NMM) 2.2.1, 2.3 before build 122, and 2.4 before build 375 allows remote attackers to execute arbitrary code by sending a crafted message over a TCP communication channel. El cliente de EMC NetWorker Module para Microsoft Applications (NMM) v2.2.1, v2.3 anterior al build v122, y v2.4 anterior al build 375 permite a atacantes remotos ejecutar código arbitrario mediante el envío de un mensaje elaborado por un canal de comunicación TCP. • http://archives.neohapsis.com/archives/bugtraq/2012-10/0068.html http://osvdb.org/86158 http://secunia.com/advisories/50957 http://www.securityfocus.com/bid/55883 http://www.securitytracker.com/id?1027647 • CWE-94: Improper Control of Generation of Code ('Code Injection') •