Emc vulnerabilities
407 vulnerabilities
Known vulnerabilities in Emc products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 170 products.
Products
50 of 170- Rsa Authentication Manager25 vulnerabilities
- Rsa Archer Egrc23 vulnerabilities
- Documentum Content Server21 vulnerabilities
- Networker19 vulnerabilities
- Isilon Onefs15 vulnerabilities
- Avamar Server13 vulnerabilities
- Documentum Webtop13 vulnerabilities
- Documentum D212 vulnerabilities
- Documentum Taskspace12 vulnerabilities
- Rsa Identity Management And Governance11 vulnerabilities
- Avamar10 vulnerabilities
- Documentum Administrator10 vulnerabilities
- Documentum Wdk10 vulnerabilities
- Rsa Adaptive Authentication On Premise10 vulnerabilities
- Vipr Srm10 vulnerabilities
- Data Protection Advisor9 vulnerabilities
- Rsa Identity Governance And Lifecycle8 vulnerabilities
- Secure Remote Services8 vulnerabilities
- Documentum Eroom7 vulnerabilities
- Recoverpoint7 vulnerabilities
- Rsa Archer Smartsuite7 vulnerabilities
- Document Sciences Xpression6 vulnerabilities
- Documentum Digital Asset Manager6 vulnerabilities
- Legato Networker6 vulnerabilities
- Smarts Network Configuration Manager6 vulnerabilities
- Vplex Geosynchrony6 vulnerabilities
- Appsync5 vulnerabilities
- Documentum Capital Projects5 vulnerabilities
- Documentum Web Publisher5 vulnerabilities
- Recoverpoint For Virtual Machines5 vulnerabilities
- Replication Manager5 vulnerabilities
- Replistor5 vulnerabilities
- Rsa Certificate Manager5 vulnerabilities
- Rsa Data Loss Prevention5 vulnerabilities
- Scaleio5 vulnerabilities
- Watch4Net5 vulnerabilities
- Alphastor4 vulnerabilities
- Autostart4 vulnerabilities
- Avamar Server Virtual Edition4 vulnerabilities
- Documentum Records Manager4 vulnerabilities
- Rsa Authentication Agent4 vulnerabilities
- Rsa Security Analytics4 vulnerabilities
- Sourceone Email Supervisor4 vulnerabilities
- Cloud Tiering Appliance3 vulnerabilities
- Diskxtender3 vulnerabilities
- Documentum Xcp3 vulnerabilities
- Integrated Data Protection Appliance3 vulnerabilities
- Networker Module For Microsoft Applications3 vulnerabilities
- Rsa Archer Grc3 vulnerabilities
- Rsa Bsafe Ssl J3 vulnerabilities
CVE-2018-1220emcrsa_archer
EPSS score1.75%
EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerability to redirect genuine users to phishing websites with the intent of obtaining sensitive information from the users.CVE-2018-1242dell emcdell emc recoverpoint+3EPSS score2.64%
Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability in the Boxmgmt CLI. An authenticated malicious user with boxmgmt privileges may potentially exploit this vulnerability to read RPA files. Note that files that require root permission cannot be read.CVE-2018-1255emcrsa_identity_governance_and_lifecycle+1EPSS score1.30%
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.CVE-2018-1182emcrsa_identity_governance_and_lifecycle+2EPSS score0.41%
An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). It allows certain OS level users to execute arbitrary scripts with root level privileges.CVE-2018-1219emcrsa_archerEPSS score1.76%
EMC RSA Archer, versions prior to 6.2.0.8, contains an improper access control vulnerability on an API which is used to enumerate user information. A remote authenticated malicious user can potentially exploit this vulnerability to gather information about the user base and may use this information in subsequent attacks.CVE-2018-1254emcrsa_authentication_manager+1EPSS score2.03%
RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim Security Console administrator to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser.CVE-2018-1253emcrsa_authentication_manager+1EPSS score1.48%
RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.CVE-2018-1245emcrsa_identity_governance_and_lifecycle+1EPSS score2.49%
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system.CVE-2018-1235dell emcdell emc recoverpoint+3EPSS score42.20%
Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege.CVE-2018-1241dell emcdell emc recoverpoint+3EPSS score1.51%
Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP password in plain-text into the RecoverPoint log file. An authenticated malicious user with access to the RecoverPoint log files may obtain the exposed LDAP password to use it in further attacks.CVE-2018-1240dell emcvipr controller+1EPSS score0.53%
Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user, having access to the vCloud subnet where ViPR is deployed, could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system.CVE-2018-1206emcdata_protection_advisorEPSS score0.34%
Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contain a hardcoded database account with administrative privileges. The affected account is "apollosuperuser." An attacker with local access to the server where DPA Datastore Service is installed and knowledge of the password may potentially gain unauthorized access to the database. Note: The Datastore Service database cannot be accessed remotely using this account.CVE-2018-11071dell emcisilon onefs+3EPSS score1.85%
Dell EMC Isilon OneFS versions 7.1.1.x, 7.2.1.x, 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 and Dell EMC IsilonSD Edge versions 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 contain a remote process crash vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to crash the isi_drive_d process by sending specially crafted input data to the affected system. This process will then be restarted.CVE-2018-11049emcrsa_identity_governance_and_lifecycle+3EPSS score0.45%
RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scripts set an environment variable in an unintended manner. A local authenticated malicious user could trick the root user to run malicious code on the targeted system.CVE-2018-11061dell emcrsa netwitness+3EPSS score4.98%
RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server user with an Admin or Operator role could exploit this vulnerability to execute arbitrary commands on the server with root privileges.CVE-2018-11073emcrsa_authentication_manager+1EPSS score1.11%
RSA Authentication Manager versions prior to 8.3 P3 contain a stored cross-site scripting vulnerability in the Operations Console. A malicious Operations Console administrator could exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser.CVE-2018-11051emcrsa_certificate_manager+1EPSS score2.60%
RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST Enroll Server. A remote unauthenticated attacker could potentially exploit this vulnerability by manipulating input parameters of the application to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.CVE-2018-11074emcrsa_authentication_manager+1EPSS score2.03%
RSA Authentication Manager versions prior to 8.3 P3 are affected by a DOM-based cross-site scripting vulnerability which exists in its embedded MadCap Flare Help files. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to the browser DOM, which code is then executed by the web browser in the context of the vulnerable web application.CVE-2018-11079dell emcesrs virtual edition+1EPSS score0.37%
Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain access to the application database.CVE-2018-11075emcrsa_authentication_manager+1EPSS score1.49%
RSA Authentication Manager versions prior to 8.3 P3 contain a reflected cross-site scripting vulnerability in a Security Console page. A remote, unauthenticated malicious user, with the knowledge of a target user's anti-CSRF token, could potentially exploit this vulnerability by tricking a victim Security Console user to supply malicious HTML or JavaScript code to the vulnerable web application, which code is then executed by the victim's web browser in the context of the vulnerable web application.