Vulnerabilidades

Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior), Dell Command | Update, Dell Update, and Alienware Update versions before 4.5 contain a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user may…

Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileges may potentially exploit this vulnerability to perform arbitrary code execution or cause denial of service.

Dell PowerEdge BIOS and Dell Precision BIOS contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by manipulating an SMI to cause a denial of service during SMM.

Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability. An authenticated non-admin user could potentially exploit the issue and obtain sensitive information.

Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnerability. This may lead to disclosing sensitive information to a locally privileged user. .

Dell PowerScale OneFS, versions 8.2.x through 9.4.x contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected fields.

Dell Command | Monitor en sus versiones anteriores a la 10.9 contienen una vulnerabilidad de eliminación de carpeta arbitraria durante la desinstalación. Un usuario malintencionado autenticado localmente puede explotar esta vulnerabilidad y provocar la eliminación arbitraria de una carpeta.

Dell Alienware Command Center en su versión 5.5.37.0 y anteriores contienen una vulnerabilidad de validación de entrada incorrecta. Un usuario malintencionado autenticado local podría potencialmente enviar entradas maliciosas a una canalización con nombre para elevar los privilegios en el sistema.

Dell Command | Update, Dell Update, and Alienware Update anteriores a 4.6.0 y 4.7.1 contienen operación insegura en Windows Junction en el componente del instalador. Un usuario malintencionado local podría explotar esta vulnerabilidad y provocar la eliminación arbitraria de archivos.

Dell BIOS contiene una vulnerabilidad de exposición de información. Un atacante local no autenticado con acceso físico al sistema y conocimiento de la configuración del sistema podría explotar esta vulnerabilidad para leer información del sistema a través de interfaces de depuración.

Dell PowerScale OneFS, versiones 8.2.x-9.3.x, contiene un desbordamiento de búfer basado en almacenamiento dinámico. Un usuario local malicioso con privilegios podría explotar esta vulnerabilidad y tomar el control del sistema. Esto afecta a los clústeres de modo de cumplimiento.

PowerPath Management Appliance con versiones 3.3, 3.2*, 3.1 y 3.1. 3.0* contiene una vulnerabilidad de divulgación de información confidencial. Un usuario administrador autenticado puede aprovechar el problema y ver información confidencial almacenada en los registros.

Dell Command Intel vPro Out of Band, versiones anteriores a la 4.3.1, contienen una vulnerabilidad de autorización incorrecta. Un usuario malintencionado autenticado localmente podría explotar esta vulnerabilidad para escribir archivos arbitrarios en el sistema.

EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) irrespective of any auth used.

Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication component. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to uncontrolled resource consumption by creating permanent home directories for…

Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privileges user could potentially exploit this vulnerability, leading to information disclosure and escalation of privileges.

Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI module. A low-privileged user with permission to read logs on the cluster could potentially exploit this vulnerability, leading to Information disclosure and denial of service.

Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privileged local attacker could potentially exploit this vulnerability, leading to sensitive information disclosure.

Dell EMC prior to version DDOS 7.9 contain(s) an OS command injection Vulnerability. An authenticated non admin attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application.

Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A low privilege local attacker could potentially exploit this vulnerability, leading to system takeover.

Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.

Dell PowerScale OneFS 8.2.x, 9.0.0.x - 9.4.0.x, contain an insufficient resource pool vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.

Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary \u2018Host\u2019 header values to poison a web cache or trigger redirections.

Dell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation vulnerability. An remote unauthenticated attacker could potentially exploit this vulnerability, leading to a full compromise of the system.

Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit this vulnerability, leading to a full system compromise