CVSS: 10.0EPSS: 0%CPEs: 18EXPL: 0CVE-2017-15548
https://notcve.org/view.php?id=CVE-2017-15548
An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote unauthenticated malicious user can potentially bypass application authentication and gain unauthorized root access to the affected systems. Se ha descubierto un problema en EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x y EMC Integrated Data Protection Appliance 2.0. Un usuario remoto malicioso no autenticado puede omitir la autenticación de la aplicación y obtener acceso root no autorizado a los sistemas afectados. • http://seclists.org/fulldisclosure/2018/Jan/17 http://www.securityfocus.com/bid/102352 http://www.securitytracker.com/id/1040070 • CWE-287: Improper Authentication •
CVSS: 9.0EPSS: 0%CPEs: 18EXPL: 0CVE-2017-15549
https://notcve.org/view.php?id=CVE-2017-15549
An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could potentially upload arbitrary maliciously crafted files in any location on the server file system. Se ha descubierto un problema en EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x y EMC Integrated Data Protection Appliance 2.0. Un usuario remoto malicioso con bajos privilegios podría cargar archivos arbitrarios maliciosamente manipulados en cualquier ubicación del sistema de archivos del servidor. • http://seclists.org/fulldisclosure/2018/Jan/17 http://www.securityfocus.com/bid/102363 http://www.securitytracker.com/id/1040070 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 0%CPEs: 18EXPL: 0CVE-2017-15550
https://notcve.org/view.php?id=CVE-2017-15550
An issue was discovered in EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x; and EMC Integrated Data Protection Appliance 2.0. A remote authenticated malicious user with low privileges could access arbitrary files on the server file system in the context of the running vulnerable application via Path traversal. Se ha descubierto un problema en EMC Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4.x, 7.5.0; EMC NetWorker Virtual Edition (NVE) 9.0.x, 9.1.x, 9.2.x y EMC Integrated Data Protection Appliance 2.0. Un usuario autenticado remoto malicioso con bajos privilegios podría acceder a archivos arbitrarios en el sistema de archivos del servidor en el contexto de la aplicación vulnerable en ejecución mediante un salto de directorio. • http://seclists.org/fulldisclosure/2018/Jan/17 http://www.securityfocus.com/bid/102358 http://www.securitytracker.com/id/1040070 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2017-14387
https://notcve.org/view.php?id=CVE-2017-14387
The NFS service in EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1, and 8.0.0.0 - 8.0.0.4 maintains default NFS export settings (including the NFS export security flavor for authentication) that can be leveraged by current and future NFS exports. This NFS service contained a flaw that did not properly propagate changes made to the default security flavor to all new and existing NFS exports that are configured to use default NFS export settings and that are mounted after those changes are made. This flaw may potentially allow NFS clients to access affected NFS exports using the default and potentially weaker security flavor even if a more secure one was selected to be used by the OneFS administrator, aka an "NFS Export Security Setting Fallback Vulnerability." El servicio NFS en EMC Isilon OneFS 8.1.0.0, 8.0.1.0 - 8.0.1.1 y 8.0.0.0 - 8.0.0.4 mantiene las opciones de exportación NFS por defecto (incluyendo la parte especifica de seguridad del "NFS export" para autenticación) que puede aprovecharse para exportaciones NFS actuales y futuras. El servicio NFS contenía un error que no propagaba correctamente los cambios realizados en la parte específica de seguridad para todas las exportaciones NFS nuevas y existentes que están configuradas para emplear opciones de exportación NFS por defecto y están montadas una vez se han realizado esos cambios. • http://seclists.org/fulldisclosure/2017/Dec/78 http://www.securityfocus.com/bid/102292 •
CVSS: 7.5EPSS: 4%CPEs: 7EXPL: 0CVE-2017-14385
https://notcve.org/view.php?id=CVE-2017-14385
An issue was discovered in EMC Data Domain DD OS 5.7 family, versions prior to 5.7.5.6; EMC Data Domain DD OS 6.0 family, versions prior to 6.0.2.9; EMC Data Domain DD OS 6.1 family, versions prior to 6.1.0.21; EMC Data Domain Virtual Edition 2.0 family, all versions; EMC Data Domain Virtual Edition 3.0 family, versions prior to 3.0 SP2 Update 1; and EMC Data Domain Virtual Edition 3.1 family, versions prior to 3.1 Update 2. EMC Data Domain DD OS contains a memory overflow vulnerability in SMBv1 which may potentially be exploited by an unauthenticated remote attacker. An attacker may completely shut down both the SMB service and active directory authentication. This may also allow remote code injection and execution. Se ha descubierto un problema en la familia de productos EMC Data Domain DD OS 5.7, en versiones anteriores a la 5.7.5.6; la familia de productos EMC Data Domain DD OS 6.0, en versiones anteriores a la 6.0.2.9; la familia de productos EMC Data Domain DD OS 6.1, en versiones anteriores a la 6.1.0.21; la familia de productos EMC Data Domain Virtual Edition 2.0 en todas sus versiones; la familia de productos EMC Data Domain Virtual Edition 3.0, en versiones anteriores a la 3.0 SP2 Update 1 y la familia de productos EMC Data Domain Virtual Edition 3.1, en versiones anteriores a la 3.1 Update 2. • http://seclists.org/fulldisclosure/2017/Dec/79 http://www.securityfocus.com/bid/102289 http://www.securitytracker.com/id/1040027 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •