CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21543
https://notcve.org/view.php?id=CVE-2021-21543
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Dell EMC iDRAC9 versiones anteriores a 4.40.00.00, contienen múltiples vulnerabilidades de tipo cross-site scripting almacenado. Un usuario malicioso autenticado remoto con privilegios elevados podría explotar estas vulnerabilidades para almacenar código HTML o JavaScript malicioso por medio de múltiples parámetros afectados. • https://www.dell.com/support/kbdoc/000185293 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21542
https://notcve.org/view.php?id=CVE-2021-21542
Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Dell EMC iDRAC9 versiones anteriores a 4.40.10.00, contienen múltiples vulnerabilidades de tipo cross-site scripting almacenado. Un usuario malicioso autenticado remoto con altos privilegios podría explotar estas vulnerabilidades para almacenar código HTML o JavaScript malicioso por medio de múltiples afectaciones mientras genera un certificado. • https://www.dell.com/support/kbdoc/000185293 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21541
https://notcve.org/view.php?id=CVE-2021-21541
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application. Dell EMC iDRAC9 versiones anteriores a 4.40.00.00, contiene una vulnerabilidad de tipo cross-site scripting basada en DOM. Un atacante remoto no autenticado podría explotar potencialmente esta vulnerabilidad engañando al usuario de la aplicación víctima para que suministre un código HTML o JavaScript malicioso al entorno DOM en el navegador. • https://www.dell.com/support/kbdoc/000185293 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21540
https://notcve.org/view.php?id=CVE-2021-21540
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to overwrite configuration information by injecting arbitrarily large payload. Dell EMC iDRAC9 versiones anteriores a 4.40.00.00, contiene una vulnerabilidad de desbordamiento en la región stack de la memoria. Un atacante autenticado remoto podría explotar potencialmente esta vulnerabilidad para sobrescribir la información de configuración al inyectar una carga útil arbitrariamente grande. • https://www.dell.com/support/kbdoc/000185293 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21539
https://notcve.org/view.php?id=CVE-2021-21539
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface. Dell EMC iDRAC9 versiones anteriores a 4.40.00.00, contiene una vulnerabilidad de condición de carrera Time-of-check Time-of-use (TOCTOU). Un atacante autenticado remoto podría explotar potencialmente esta vulnerabilidad para alcanzar privilegios elevados cuando un usuario con privilegios más elevados accede simultáneamente a iDRAC a través de la interfaz web. • https://www.dell.com/support/kbdoc/000185293 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •