Emc Vipr Srm vulnerabilities

10 CVEs affecting Emc Vipr Srm, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-6647, published 2016-09-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-0514, published 2015-01-21. Medium severity, CVSS 5.0. EPSS: 7.6% chance of exploitation in the next 30 days. EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 might allow remote attackers to obtain cleartext data-center discovery credentials by leveraging certain SRM access to conduct a…
CVE-2015-0516, published 2015-01-21. Medium severity, CVSS 4.0. EPSS: 7.4% chance of exploitation in the next 30 days. Directory traversal vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to read arbitrary files via a crafted URL.
CVE-2016-0891, published 2016-04-20. High severity, CVSS 8.8. EPSS: 3.6% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in administrative pages in EMC ViPR SRM before 3.7 allow remote attackers to hijack the authentication of administrators.
CVE-2015-0515, published 2015-01-21. Medium severity, CVSS 6.5. EPSS: 2.9% chance of exploitation in the next 30 days. Unrestricted file upload vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to execute arbitrary code by uploading and then accessing an…
CVE-2015-0513, published 2015-01-21. Low severity, CVSS 3.5. EPSS: 1.6% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject…
CVE-2016-0922, published 2016-09-18. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. EMC ViPR SRM before 3.7.2 does not restrict the number of password-authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force guessing attack.
CVE-2016-6647, published 2016-09-30. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-6643, published 2016-09-18. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-6641, published 2016-09-18. High severity, CVSS 7.6. EPSS: 0.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in EMC ViPR SRM before 3.7.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-6642, published 2016-09-18. Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in EMC ViPR SRM before 3.7.2 allows remote attackers to hijack the authentication of administrators for requests that upload files.