CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-33935
https://notcve.org/view.php?id=CVE-2022-33935
30 Aug 2022 — Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request ... • https://www.dell.com/support/kbdoc/en-us/000201824/dsa-2022-107-dell-emc-data-protection-advisor-dpa-security-update-for-stored-cross-site-scripting-vulnerability • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-5351
https://notcve.org/view.php?id=CVE-2020-5351
28 Jul 2021 — Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only privileges. Dell EMC Data Protection Advisor versiones 6.4, 6.5 y 18.1, contienen una cuenta no documentada con privilegios limitados que está protegida con una contraseña embebida. Un usuario remoto malicioso no autentic... • https://www.dell.com/support/security/en-us/details/542649/DSA-2020-080-Dell-EMC-Data-Protection-Advisor-Hard-Coded-Credential-Vulnerability • CWE-259: Use of Hard-coded Password •
CVSS: 9.0EPSS: 6%CPEs: 3EXPL: 0CVE-2020-5352
https://notcve.org/view.php?id=CVE-2020-5352
06 Jul 2020 — Dell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may exploit this vulnerability to execute arbitrary commands on the affected system. Dell EMC Data Protection Advisor versiones 6.4, 6.5 y 18.1, contiene una vulnerabilidad de inyección de comandos del Sistema Operativo. Un usuario malicioso autenticado remoto puede explotar esta vulnerabilidad para ejecutar comandos arbitrarios en el sistema afectado • https://www.dell.com/support/security/en-us/details/542719/DSA-2020-081-Dell-EMC-Data-Protection-Advisor-OS-Command-Injection-Vulnerability • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.1EPSS: 2%CPEs: 15EXPL: 0CVE-2019-18582
https://notcve.org/view.php?id=CVE-2019-18582
18 Mar 2020 — Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this vulnerability to inject malicious report generation scripts in the server. This may lead to OS command execution as the regular user runs the DPA service on the affected system. Dell EMC Data Protection Advisor versi... • https://www.dell.com/support/security/en-us/details/539430/DSA-2019-155-Dell-EMC-Data-Protection-Advisor-Security-Update-for-Multiple-Vulnerabilities • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.1EPSS: 1%CPEs: 15EXPL: 0CVE-2019-18581
https://notcve.org/view.php?id=CVE-2019-18581
18 Mar 2020 — Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authorization vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this vulnerability to alter the application’s allowable list of OS commands. This may lead to arbitrary OS command execution as the regular user runs the DPA service on the affected system. Dell EMC Data Protection Advisor ... • https://www.dell.com/support/security/en-us/details/539430/DSA-2019-155-Dell-EMC-Data-Protection-Advisor-Security-Update-for-Multiple-Vulnerabilities • CWE-862: Missing Authorization •
CVSS: 8.1EPSS: 0%CPEs: 6EXPL: 0CVE-2018-11048 – Dell EMC Data Protection Advisor XML Injection
https://notcve.org/view.php?id=CVE-2018-11048
06 Aug 2018 — Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External Entity (XXE) Injection vulnerability in the REST API. An authenticated remote malicious user could potentially exploit this vulnerability to read certain system files in the server or cause denial of service by supplying specially crafted Document Type Definitions (DTDs) in an XML request. Dell EMC Data Protection Advisor, en versiones 6.2, 6,3, 6.4 ... • http://seclists.org/fulldisclosure/2018/Aug/5 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2016-8211 – EMC Data Protection Advisor ImageServlet Directory Traversal Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2016-8211
28 Jan 2017 — EMC Data Protection Advisor 6.1.x, EMC Data Protection Advisor 6.2, EMC Data Protection Advisor 6.2.1, EMC Data Protection Advisor 6.2.2, EMC Data Protection Advisor 6.2.3 prior to patch 446 has a path traversal vulnerability that may potentially be exploited by malicious users to compromise the affected system. EMC Data Protection Advisor 6.1.x, EMC Data Protection Advisor 6.2, EMC Data Protection Advisor 6.2.1, EMC Data Protection Advisor 6.2.2, EMC Data Protection Advisor 6.2.3 anterior al parche 446 tie... • http://www.securityfocus.com/archive/1/540067/30/0/threaded • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •