CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21601
https://notcve.org/view.php?id=CVE-2021-21601
Dell EMC Data Protection Search, 19.4 and prior, and IDPA, 2.6.1 and prior, contain an Information Exposure in Log File Vulnerability in CIS. A local low privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with the privileges of the compromised account. Dell EMC Data Protection Search, versiones 19.4 y anteriores, e IDPA, 2.6.1 y anteriores, contienen una vulnerabilidad de Exposición de Información en Archivos de Registro en CIS. Un atacante local poco privilegiado podría explotar potencialmente esta vulnerabilidad, conllevando a la divulgación de determinadas credenciales de usuario. • https://www.dell.com/support/kbdoc/000189555 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 10.0EPSS: 0%CPEs: 13EXPL: 0CVE-2020-5341
https://notcve.org/view.php?id=CVE-2020-5341
Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 and 2.4.1 contain a Deserialization of Untrusted Data Vulnerability. A remote unauthenticated attacker could exploit this vulnerability to send a serialized payload that would execute code on the system. Vulnerabilidad de deserialización de datos no confiables Las versiones 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 y 19.2 de Dell EMC Avamar Server y las versiones 2.0, 2.1, 2.2, 2.3, 2.4 y 2.4.1 de Dell EMC Integrated Data Protection Appliance contienen una vulnerabilidad de deserialización de datos no confiables. Un atacante remoto no autenticado podría aprovechar esta vulnerabilidad para enviar una carga útil serializada que ejecutaría código en el sistema. • https://www.dell.com/support/security/en-us/details/541677/DSA-2020-057-Dell-EMC-Avamar-Server-Deserialization-of-Untrusted-Data-Vulnerability • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.2EPSS: 0%CPEs: 10EXPL: 0CVE-2019-3752
https://notcve.org/view.php?id=CVE-2019-3752
Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2 and 19.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1, 2.2, 2.3 and 2.4. contain an XML External Entity(XXE) Injection vulnerability. A remote unauthenticated malicious user could potentially exploit this vulnerability to cause Denial of Service or information exposure by supplying specially crafted document type definitions (DTDs) in an XML request. Dell EMC Avamar Server versiones 7.4.1, 7.5.0, 7.5.1, 18.2 y 19.1 de y Dell EMC Integrated Data Protection Appliance (IDPA) versiones 2.0, 2.1, 2.2, 2.3 y 2.4, contienen una vulnerabilidad de tipo XML External Entity(XXE). Un usuario remoto malicioso no autenticado podría potencialmente explotar esta vulnerabilidad para causar una Denegación de Servicio o la exposición de información al suministrar definiciones de tipo de documento (DTD) especialmente diseñadas en una petición XML • https://www.dell.com/support/security/en-us/details/537853/DSA-2019-119-Dell-EMC-Avamar-XML-External-Entity-Injection-Vulnerability • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2021-21511
https://notcve.org/view.php?id=CVE-2021-21511
Dell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in the web UI. A remote low privileged attacker could potentially exploit this vulnerability, to gain unauthorized read or modification access to other users' backup data. Dell EMC Avamar Server, versiones 19.3 y 19.4, contienen una vulnerabilidad de Autorización Inapropiada en la Interfaz de Usuario web. Un atacante remoto con pocos privilegios podría aprovechar esta vulnerabilidad para obtener acceso no autorizado de lectura o modificación a los datos de respaldo de otros usuarios • https://www.dell.com/support/kbdoc/en-us/000182926/dsa-2021-033-dell-emc-avamar-server-improper-authorization-vulnerability • CWE-285: Improper Authorization •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 0CVE-2020-29495
https://notcve.org/view.php?id=CVE-2020-29495
DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS with high privileges. This vulnerability is considered critical as it can be leveraged to completely compromise the vulnerable application as well as the underlying operating system. Dell recommends customers to upgrade at the earliest opportunity. DELL EMC Avamar Server, versiones 19.1, 19.2, 19.3, contienen una vulnerabilidad de inyección de comandos del sistema operativo en Fitness Analyzer. • https://www.dell.com/support/kbdoc/en-us/000181806/dsa-2020-272-dell-emc-avamar-server-security-update-for-multiple-vulnerabilities • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •