| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 6 Oct 2017 16:27:18 +0000 From: EMC Product Security Response Center <Security_Alert@....com> To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org> Subject: [FD] ESA-2017-112: EMC Network Configuration Manager Reflected Cross-Site Scripting Vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ESA-2017-112: EMC Network Configuration Manager Reflected Cross-Site Scripting Vulnerability EMC Identifier: ESA-2017-112 CVE Identifier: CVE-2017-8017 Severity Rating: CVSSv3 Base Score: 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Affected products: * EMC Network Configuration Manager (NCM) 9.3.x * EMC Network Configuration Manager (NCM) 9.4.0.x * EMC Network Configuration Manager (NCM) 9.4.1.x * EMC Network Configuration Manager (NCM) 9.4.2.x Summary: EMC Network Configuration Manager (NCM) is affected by a reflected cross-site scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system. Details: The Report Advisor component in EMC Network Configuration Manager (NCM) is affected by a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary HTML in the user's browser session in the context of the affected application. Resolution: The following EMC Network Configuration Manager release contains resolution to this vulnerability: * EMC Network Configuration Manager version 9.5 EMC recommends all customers upgrade at the earliest opportunity. Link to remedies: https://support.emc.com/products/31946_Service-Assurance-Suite Credit: EMC would like to thank Lukasz Plonka for reporting this issue. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJZ1mSSAAoJEHbcu+fsE81Zul4H/0rz/w9V+zWyjUowYuYgKWOd c03fYbO6BEdJ/HZ05eblXDnNtp3HC6B+Z0PH8PlapfIxvGLezRvb2oidyy/BoNdc TMlVsSb9hJWEMykRMWsyT94C/wqzp3Cjm5qi8jFSdzMjfCqbaaAWCpgyg6F1VMCy vc6SAGHL9qfBqzQ1f2WR6sZMsG16qu9VgsmLciYPCGhfmqBMiWgdhcOf3cS+aDOO 6FX2ZrDuumxfFaWoS9+pG5Nz65RHTVljn6t3Xo+NhfQDS/bVbWjv8m/Jd8M0dwuL cAZsM2ukWP8DVDX0xFd0CTioPS9s2DyvThacPF1rCn7Q5qC0OgV6cAqcNgRPfsM= =QUiL -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists