CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1240 – Dell EMC ViPR Controller Information Exposure
https://notcve.org/view.php?id=CVE-2018-1240
13 Apr 2018 — Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user, having access to the vCloud subnet where ViPR is deployed, could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system. Dell EMC ViPR Controller, en versione... • http://seclists.org/fulldisclosure/2018/Apr/29 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1206 – Dell EMC Data Protection Advisor Hardcoded Password
https://notcve.org/view.php?id=CVE-2018-1206
08 Mar 2018 — Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contain a hardcoded database account with administrative privileges. The affected account is "apollosuperuser." An attacker with local access to the server where DPA Datastore Service is installed and knowledge of the password may potentially gain unauthorized access to the database. Note: The Datastore Service database cannot be accessed remotely using this account. Dell EMC... • http://seclists.org/fulldisclosure/2018/Mar/22 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2018-1182 – RSA Identity Governance and Lifecycle Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-1182
06 Mar 2018 — An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). It allows certain OS level users to execute arbitrary scripts with root leve... • http://seclists.org/fulldisclosure/2018/Mar/16 • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1219 – RSA Archer GRC Platform User Enumeration / Open Redirect
https://notcve.org/view.php?id=CVE-2018-1219
06 Mar 2018 — EMC RSA Archer, versions prior to 6.2.0.8, contains an improper access control vulnerability on an API which is used to enumerate user information. A remote authenticated malicious user can potentially exploit this vulnerability to gather information about the user base and may use this information in subsequent attacks. EMC RSA Archer, en versiones anteriores a la 6.2.0.8, contiene una vulnerabilidad de control de acceso incorrecto en una API que se utiliza para enumerar la información de usuario. Un usuar... • http://seclists.org/fulldisclosure/2018/Mar/12 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1220 – RSA Archer GRC Platform User Enumeration / Open Redirect
https://notcve.org/view.php?id=CVE-2018-1220
06 Mar 2018 — EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerability to redirect genuine users to phishing websites with the intent of obtaining sensitive information from the users. EMC RSA Archer, en versiones anteriores a la 6.2.0.8, contiene una vulnerabilidad de redirección en la característica QuickLinks. Un atacante remoto podría explotar esa vulnerabilidad para redirigir usuarios genuinos a páginas web de... • http://seclists.org/fulldisclosure/2018/Mar/12 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2017-15546 – RSA Authentication Manager 8.2 SP1 P6 SQL Injection
https://notcve.org/view.php?id=CVE-2017-15546
24 Jan 2018 — The Security Console in EMC RSA Authentication Manager 8.2 SP1 P6 and earlier is affected by a blind SQL injection vulnerability. Authenticated malicious users could potentially exploit this vulnerability to read any unencrypted data from the database. Security Console en EMC RSA Authentication Manager 8.2 SP1 P6 y anteriores está afectado por una vulnerabilidad de inyección SQL ciega. Usuarios autenticados maliciosos podrían explotar esta vulnerabilidad para leer cualquier dato sin cifrar de la base de dat... • http://seclists.org/fulldisclosure/2018/Jan/81 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2017-15548 – EMC Avamar Server / NetWorker Virtual Edition / Integrated Data Protection Applianc Bypass / Upload / Traversal
https://notcve.org/view.php?id=CVE-2017-15548
05 Jan 2018 — An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote unauthenticated malicious user can potentially bypass application authentication and gain unauthorized root access to the affected systems. Se ha descubierto un problema en EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x y EMC Integrated Data Protection A... • http://seclists.org/fulldisclosure/2018/Jan/17 • CWE-287: Improper Authentication •
CVSS: 9.0EPSS: 1%CPEs: 18EXPL: 0CVE-2017-15549 – EMC Avamar Server / NetWorker Virtual Edition / Integrated Data Protection Applianc Bypass / Upload / Traversal
https://notcve.org/view.php?id=CVE-2017-15549
05 Jan 2018 — An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could potentially upload arbitrary maliciously crafted files in any location on the server file system. Se ha descubierto un problema en EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x y EMC Integrated Data... • http://seclists.org/fulldisclosure/2018/Jan/17 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 1%CPEs: 18EXPL: 0CVE-2017-15550 – EMC Avamar Server / NetWorker Virtual Edition / Integrated Data Protection Applianc Bypass / Upload / Traversal
https://notcve.org/view.php?id=CVE-2017-15550
05 Jan 2018 — An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could access arbitrary files on the server file system in the context of the running vulnerable application via Path traversal. Se ha descubierto un problema en EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2... • http://seclists.org/fulldisclosure/2018/Jan/17 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 19%CPEs: 7EXPL: 0CVE-2017-14385 – EMC Data Domain DD OS Memory Overflow
https://notcve.org/view.php?id=CVE-2017-14385
20 Dec 2017 — An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior to 6.0.2.9; EMC Data Domain DD OS 6.1 family, versions prior to 6.1.0.21; EMC Data Domain Virtual Edition 2.0 family, all versions; EMC Data Domain Virtual Edition 3.0 family, versions prior to 3.0 SP2 Update 1; and EMC Data Domain Virtual Edition 3.1 family, versions prior to 3.1 Update 2. EMC Data Domain DD OS contains a memory overflow vulnerability in SMBv1 which may p... • http://seclists.org/fulldisclosure/2017/Dec/79 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •