Vulnerabilities > EMC > Vipr SRM > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-09-18 | CVE-2016-6643 | Cross-site Scripting vulnerability in EMC Vipr SRM 3.6.0/3.6.4 Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2016-09-18 | CVE-2016-6642 | Cross-Site Request Forgery (CSRF) vulnerability in EMC Vipr SRM 3.6.0/3.6.4 Cross-site request forgery (CSRF) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to hijack the authentication of administrators for requests that upload files. | 5.8 |
| 2016-09-18 | CVE-2016-0922 | Improper Authorization vulnerability in EMC Vipr SRM 3.6.0/3.6.4 EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing attack. | 5.0 |
| 2016-04-20 | CVE-2016-0891 | Cross-Site Request Forgery (CSRF) vulnerability in EMC Vipr SRM 3.6.0/3.6.4 Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authentication of administrators. | 6.8 |
| 2015-01-21 | CVE-2015-0516 | Path Traversal vulnerability in EMC Vipr SRM and Watch4Net Directory traversal vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to read arbitrary files via a crafted URL. | 4.0 |
| 2015-01-21 | CVE-2015-0515 | Arbitrary File Upload vulnerability in EMC Vipr SRM and Watch4Net Unrestricted file upload vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to execute arbitrary code by uploading and then accessing an executable file. | 6.5 |
| 2015-01-21 | CVE-2015-0514 | Information Exposure vulnerability in EMC Vipr SRM and Watch4Net EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 might allow remote attackers to obtain cleartext data-center discovery credentials by leveraging certain SRM access to conduct a decryption attack. | 5.0 |