CVSS: 8.0EPSS: 0%CPEs: 8EXPL: 0CVE-2022-31233
https://notcve.org/view.php?id=CVE-2022-31233
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability. An adjacent malicious user may potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to. Unisphere for PowerMax versiones anteriores a 9.2.3.15, contienen una vulnerabilidad de escalada de privilegios. Un usuario malicioso adyacente puede explotar potencialmente esta vulnerabilidad para escalar sus privilegios y acceder a funcionalidades a las que no presenta acceso • https://www.dell.com/support/kbdoc/000200975 • CWE-602: Client-Side Enforcement of Server-Side Security CWE-669: Incorrect Resource Transfer Between Spheres •
CVSS: 7.8EPSS: 0%CPEs: 13EXPL: 0CVE-2021-36339
https://notcve.org/view.php?id=CVE-2021-36339
The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts. A local malicious user may potentially exploit this vulnerability to get privileged access to the virtual appliance. Los dispositivos virtuales de Dell EMC versiones anteriores a 9.2.2.2, contienen cuentas de usuario no documentadas. Un usuario local malicioso puede explotar potencialmente esta vulnerabilidad para conseguir acceso privilegiado al dispositivo virtual • https://www.dell.com/support/kbdoc/000194640 • CWE-250: Execution with Unnecessary Privileges •
CVSS: 8.0EPSS: 0%CPEs: 13EXPL: 0CVE-2021-36338
https://notcve.org/view.php?id=CVE-2021-36338
Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to. CVE-2022-31233 addresses the partial fix in CVE-2021-36338. Las versiones de Unisphere for PowerMax anteriores a la 9.2.2.2 contienen una vulnerabilidad de escalada de privilegios. Un usuario malintencionado adyacente podría explotar esta vulnerabilidad para escalar sus privilegios y acceder a funcionalidades a las que no tiene acceso. • https://www.dell.com/support/kbdoc/000194640 • CWE-565: Reliance on Cookies without Validation and Integrity Checking CWE-602: Client-Side Enforcement of Server-Side Security •
CVSS: 8.1EPSS: 0%CPEs: 9EXPL: 0CVE-2021-21531
https://notcve.org/view.php?id=CVE-2021-21531
Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulnerability to perform unauthorized actions. Dell Unisphere para PowerMax versiones anteriores a 9.2.1.6, contienen una vulnerabilidad de Omisión de Autorización. Un usuario malicioso local autenticado con role de monitor puede explotar esta vulnerabilidad para llevar a cabo acciones no autorizadas. • https://www.dell.com/support/kbdoc/000184565 • CWE-602: Client-Side Enforcement of Server-Side Security CWE-669: Incorrect Resource Transfer Between Spheres •
CVSS: 9.8EPSS: 0%CPEs: 27EXPL: 0CVE-2018-1183
https://notcve.org/view.php?id=CVE-2018-1183
In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service. En Dell EMC Unisphere for VMAX Virtual Appliance en versiones anteriores a la 8.4.0.8; Dell EMC Solutions Enabler Virtual Appliance en versiones anteriores a la 8.4.0.8; Dell EMC VASA Provider Virtual Appliance en versiones anteriores a la 8.4.0.512; Dell EMC SMIS en versiones anteriores a la 8.4.0.6; Dell EMC VMAX Embedded Management (eManagement) en versiones anteriores, e incluyendo, la 1.4.0.347; Dell EMC VNX2 Operating Environment (OE) for File en versiones anteriores a la 8.1.9.231; Dell EMC VNX2 Operating Environment (OE) for Block en versiones anteriores a la 05.33.009.5.231; Dell EMC VNX1 Operating Environment (OE) for File en versiones anteriores a la 7.1.82.0; Dell EMC VNX1 Operating Environment (OE) for Block en versiones anteriores a la 05.32.000.5.225; Dell EMC VNXe3200 Operating Environment (OE) en todas las versiones; Dell EMC VNXe1600 Operating Environment (OE) en versiones anteriores a la 3.1.9.9570228; Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) en todas las versiones, Dell EMC ViPR SRM en versiones 3.7, 3.7.1 y 3.7.2 (solo si se usa Dell EMC Host Interface for Windows); Dell EMC ViPR SRM en versiones 4.0, 4.0.1, 4.0.2 y 4.0.3 (solo si se usa Dell EMC Host Interface for Windows); Dell EMC XtremIO en versiones 4.x; Dell EMC VMAX eNAS en versiones 8.x y Dell EMC Unity Operating Environment (OE) en versiones anteriores a la 4.3.0.1522077968, ECOM se ha visto afectado por una vulnerabilidad de XEE (XML External Entity) debido a la configuración del analizador de XML distribuido con el producto. Podría ocurrir un ataque de inyección XEE cuando las entradas que contienen una referencia a una entidad externa (definida por un atacante) son procesadas por un analizador XML afectado. • http://seclists.org/fulldisclosure/2018/Apr/61 http://www.securityfocus.com/bid/104024 • CWE-611: Improper Restriction of XML External Entity Reference •