CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36337
https://notcve.org/view.php?id=CVE-2021-36337
21 Dec 2021 — Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible to Man-In-The-Middle attacks thereby compromising Confidentiality and Integrity of data. Dell Wyse Management Suite versiones 3.3.1 y anteriores, admiten protocolos de seguridad de transporte TLS versión 1.0 y TLS versión 1.1 no seguros que son susceptibles de ataques de tipo Man-In-The-Middle comprometiendo así la confidencialidad e integridad de los datos • https://www.dell.com/support/kbdoc/000193079 • CWE-326: Inadequate Encryption Strength •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0CVE-2021-36336
https://notcve.org/view.php?id=CVE-2021-36336
21 Dec 2021 — Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execute code on the affected system. Wyse Management Suite versiones 3.3.1 y anteriores, contienen una vulnerabilidad de deserialización que podría permitir a un atacante no autenticado ejecutar código en el sistema afectado • https://www.dell.com/support/kbdoc/000193079 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 5%CPEs: 1EXPL: 0CVE-2021-21587
https://notcve.org/view.php?id=CVE-2021-21587
15 Jul 2021 — Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability. A local unauthenticated attacker could exploit this vulnerability in order to obtain the path of files and folders. Dell Wyse Management Suite versiones 3.2 y anteriores contienen una vulnerabilidad de divulgación de ruta completa. Un atacante local no autenticado podría aprovechar esta vulnerabilidad para obtener la ruta de los archivos y carpetas • https://www.dell.com/support/kbdoc/000189363 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 46%CPEs: 1EXPL: 0CVE-2021-21586
https://notcve.org/view.php?id=CVE-2021-21586
15 Jul 2021 — Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A remote authenticated malicious user could exploit this vulnerability in order to read arbitrary files on the system. Wyse Management Suite versiones 3.2 y anteriores contienen una vulnerabilidad de salto de ruta absoluta. Un usuario malicioso no autenticado remoto podría explotar esta vulnerabilidad para leer archivos arbitrarios en el sistema • https://www.dell.com/support/kbdoc/000189363 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-36: Absolute Path Traversal •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-21533
https://notcve.org/view.php?id=CVE-2021-21533
02 Apr 2021 — Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated user can cause a denial of service in the job status retrieval page, also affecting other users that would have normally access to the same subset of job details Wyse Management Suite versiones hasta 3.2, contienen una vulnerabilidad en la que un usuario autenticado malicioso puede causar una denegación de servicio en la página de recuperación del estado del trabajo, lo que también afecta a otros usuarios que... • https://www.dell.com/support/kbdoc/en-us/000184666/dsa-2021-070-dell-wyse-management-suite-security-update-for-multiple-vulnerabilities • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-29498
https://notcve.org/view.php?id=CVE-2020-29498
04 Jan 2021 — Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites. Dell Wyse Management Suite versiones anteriores a 3.1, contienen una vulnerabilidad de redireccionamiento abi... • https://www.dell.com/support/kbdoc/en-us/000180983/dsa-2020-282 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-29497
https://notcve.org/view.php?id=CVE-2020-29497
04 Jan 2021 — Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious HTML or JavaScript code under the device tag. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Dell Wyse Management Suite versiones anteriores a 3.1, contienen una vulnerabilidad de t... • https://www.dell.com/support/kbdoc/en-us/000180983/dsa-2020-282 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-29496
https://notcve.org/view.php?id=CVE-2020-29496
04 Jan 2021 — Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with high privileges could exploit this vulnerability to store malicious HTML or JavaScript code while creating the Enduser. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Dell Wyse Management Suite versiones anteriores a 3.1, contienen una vulnerabilid... • https://www.dell.com/support/kbdoc/en-us/000180983/dsa-2020-282 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3770
https://notcve.org/view.php?id=CVE-2019-3770
13 Mar 2020 — Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability when unregistering a device. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious HTML or JavaScript code. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Dell Wyse Management Suite versiones anteriores a 1.4.1, contiene una vulnerabi... • https://www.dell.com/support/article/SLN319512 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3769
https://notcve.org/view.php?id=CVE-2019-3769
13 Mar 2020 — Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious payload in the device heartbeat request. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. Dell Wyse Management Suite versiones anteriores a 1.4.1, contiene una vulnerabilidad de tip... • https://www.dell.com/support/article/SLN319512 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •