CVSS: 9.8EPSS: 79%CPEs: 5EXPL: 1CVE-2018-1217 – Dell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control
https://notcve.org/view.php?id=CVE-2018-1217
Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials. Avamar Installation Manager en Dell EMC Avamar Server 7.3.1, 7.4.1 y 7.5.0; y Dell EMC Integrated Data Protection Appliance 2.0 y 2.1 se ha visto afectado por una vulnerabilidad de falta de control de acceso que podría permitir que un atacante remoto no autenticado lea o cambie las credenciales LDLS (Local Download Service). • https://www.exploit-db.com/exploits/44441 http://seclists.org/fulldisclosure/2018/Apr/14 http://www.securitytracker.com/id/1040641 • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1205
https://notcve.org/view.php?id=CVE-2018-1205
Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash. Dell EMC ScaleIO, en versiones anteriores a la 2.5, no gestiona correctamente algunos datos de paquetes en el servicio MDM. Como resultado, un atacante remoto podría enviar datos de paquetes especialmente manipulados al servicio MDM, lo que provocaría su cierre inesperado. • http://seclists.org/fulldisclosure/2018/Mar/59 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1237
https://notcve.org/view.php?id=CVE-2018-1237
Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LIA). This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having network access to LIA, could potentially exploit this vulnerability to launch brute force guessing of user names and passwords of user accounts on the LIA. Dell EMC ScaleIO, en versiones anteriores a la 2.5, contiene una restricción incorrecta de intentos de autenticación excesivos en el agente de instalación Light installation Agent (LIA). Este componente se implementa en cada servidor del clúster ScalelO y se emplea para la gestión central de nodos ScalelO. • http://seclists.org/fulldisclosure/2018/Mar/59 • CWE-287: Improper Authentication •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1238
https://notcve.org/view.php?id=CVE-2018-1238
Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge of the LIA administrative password, could potentially exploit this vulnerability to run arbitrary commands as root on the systems where LIAs are installed. Dell EMC ScaleIO, en versiones anteriores a la 2.5, contiene una vulnerabilidad de inyección de comandos en el agente de instalación Light installation Agent (LIA). Este componente se emplea para la gestión central de la implementación ScalelO y utiliza comandos shell para determinadas acciones. • http://seclists.org/fulldisclosure/2018/Mar/59 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1211
https://notcve.org/view.php?id=CVE-2018-1211
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a path traversal vulnerability in its Web server's URI parser which could be used to obtain specific sensitive data without authentication. A remote unauthenticated attacker may be able to read configuration settings from the iDRAC by querying specific URI strings. Dell EMC iDRAC7/iDRAC8, en versiones anteriores a la 2.52.52.52, contiene una vulnerabilidad de salto de directorio en su analizador URI del servidor web que podría utilizarse para obtener información sensible específica sin autenticación. Un atacante remoto no autenticado podría leer los ajustes de configuración del iDRAC consultando cadenas URI específicas. • http://en.community.dell.com/techcenter/extras/m/white_papers/20485410 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •