CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2018-15774 – iDRAC7/iDRAC8/iDRAC9 - Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2018-15774
Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in the Redfish interface to gain administrator access. Dell EMC iDRAC7/iDRAC8, en versiones anteriores a la 2.61.60.60, y iDRAC9 en versiones anteriores a la 3.20.21.20, 3.21.24.22, 3.21.26.22 y 3.23.23.23, contienen una vulnerabilidad de escalado de privilegios. Un usuario iDRAC malicioso autenticado con privilegios de operador podría explotar un error de comprobación de permisos en la interfaz Redfish para obtener acceso de administrador. • http://www.securityfocus.com/bid/106233 https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en • CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-15776 – iDRAC7, iDRAC8 - Improper Error Handling
https://notcve.org/view.php?id=CVE-2018-15776
Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell. Dell EMC iDRAC7/iDRAC8 en versiones anteriores a la 2.61.60.60 contiene una vulnerabilidad de manejo incorrecto de errores. Un atacante no autenticado con acceso físico al sistema podría explotar esta vulnerabilidad para obtener acceso al shell u-boot. • http://www.securityfocus.com/bid/106233 https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15773 – Dell Encryption Enterprise \ Dell Data Protection Encryption Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2018-15773
Dell Encryption (formerly Dell Data Protection | Encryption) v10.1.0 and earlier contain an information disclosure vulnerability. A malicious user with physical access to the machine could potentially exploit this vulnerability to access the unencrypted RegBack folder that contains back-ups of sensitive system files. Dell Encryption (anteriormente Dell Data Protection | Encryption), en versiones v10.1.0 y anteriores, contiene una vulnerabilidad de divulgación de información. Un usuario malicioso con acceso físico a la máquina podría explotar esta vulnerabilidad para acceder a la carpeta RegBack sin cifrar, que contiene copias de seguridad de archivos sensibles del sistema. • https://www.dell.com/support/article/us/en/04/sln314963/dell-encryption-enterprise-dell-data-protection-encryption-information-disclosure-vulnerability?lang=en • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 1%CPEs: 31EXPL: 0CVE-2018-11066 – Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-11066
Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 contain a Remote Code Execution vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary commands on the server. Dell EMC Avamar Client Manager, en las versiones 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 y 18.1 de Dell EMC Avamar Server y las 2.0, 2.1 y 2.2 de Dell EMC Integrated Data Protection Appliance (IDPA) tienen una vulnerabilidad de ejecución remota de código. Un atacante remoto no autenticado podría explotar esta vulnerabilidad para ejecutar comandos arbitrarios en el servidor. • http://www.securityfocus.com/bid/105968 http://www.securitytracker.com/id/1042153 https://seclists.org/fulldisclosure/2018/Nov/49 https://www.vmware.com/security/advisories/VMSA-2018-0029.html •
CVSS: 7.2EPSS: 0%CPEs: 31EXPL: 0CVE-2018-11077 – Dell EMC Avamar and Integrated Data Protection Appliance Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2018-11077
'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 and 2.2 is affected by an OS command injection vulnerability. A malicious Avamar admin user may potentially be able to execute arbitrary commands under root privilege. La utilidad "getlogs" en las versiones 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 y 18.1 de Dell EMC Avamar Server y las 2.0, 2.1 y 2.2 de Dell EMC Integrated Data Protection Appliance (IDPA) se ven afectadas por una vulnerabilidad de inyección de comandos en el sistema operativo. Un usuario "Avamar admin" malicioso podría ejecutar comandos arbitrarios bajo el privilegio root. • http://www.securityfocus.com/bid/105971 http://www.securitytracker.com/id/1042153 https://seclists.org/fulldisclosure/2018/Nov/51 https://www.vmware.com/security/advisories/VMSA-2018-0029.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •