Home > Resources > Technical Advisories

Technical Advisories

Technical advisories identified by the 7E team.

CVE-2015-2342 VMware vCenter Remote Code Execution

Advisory Information Title: vCenter Java JMX/RMI Remote Code Execution Date Published: 01/10/2015 CVE: CVE-2015-2342 Advisory Summary VMware vCenter Server provides a centralised platform for managing your VMware vSphere environments so you can automate and deliver a virtual infrastructure. VMware vCenter was found to bind an unauthenticated JMX/RMI service to the network stack. An attacker with […]

Read More

CVE-2013-6880 XSS in FlashCanvas Proxy.php

Advisory Information Title: FlashCanvas proxy.php XSS Vulnerability Date published: November 2013 Ref: CVE-2013-6880 Advisory Summary Script does not adequately verify the Referer header before requesting (via curl) the remote URL specified in the ‘url’ GET parameter and rendering it Vendor FlashCanvas.net <http://flashcanvas.net/> Affected Software FlashCanvas 1.5 and possibly older. FlashCanvas is also used in other software frameworks […]

Read More

CVE-2013-5669 Thecus Pain Text Admin Password

Advisory Information Title: Thecus NAS Server N8800 Firmware 5.03.01 plain text administrative password Date published: August 2013 Ref: CVE-2013-5669 CWE-319 Advisory Summary The Network Attached Storage (NAS) Administration Web Page for Thecus NAS Server N8800 transmits passwords in cleartext, which allows remote attackers to sniff the administrative password. Vendor Thecus Affected Software NAS Server N8800 […]

Read More

CVE-2013-5668 Thecus Domain Administrator Password Disclosure

Advisory Information Title: Thecus NAS Server N8800 Firmware 5.03.01 Date published: August 2013 Ref: CVE-2013-5668 CWE-317 Advisory Summary The Domain Administrator Password within the ADS/NT Support page is disclosed due to clear text storage of sensitive information within the GUI. Vendor Thecus Affected Software NAS Server N8800 Firmware 5.03.01 Description of Issue The Domain Administrator […]

Read More

CVE-2013-5667 Thecus OS Command Injection

Advisory Information Title: Thecus NAS Server N8800 Firmware 5.03.01 get_userid OS Command Injection Date published: August 2013 Ref: CVE-2013-5667 CWE-78 Advisory Summary A lack of input validation allows an attacker to execute OS commands directly on the operating system. Vendor Thecus Affected Software NAS Server N8800 Firmware 5.03.01 Description of Issue The application accepts user […]

Read More