CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-22229
https://notcve.org/view.php?id=CVE-2024-22229
Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vulnerability to forge log entries, create false alarms, and inject malicious content into logs that compromise logs integrity. A malicious attacker could also prevent the product from logging information while malicious actions are performed or implicate an arbitrary user for malicious activities. Dell Unity, versiones anteriores a la 5.4, contienen una vulnerabilidad por la cual un atacante autenticado puede falsificar los mensajes de registro. Un atacante podría aprovechar esta vulnerabilidad para falsificar entradas de registro, crear falsas alarmas e inyectar contenido malicioso en registros que comprometan su integridad. • https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities • CWE-116: Improper Encoding or Escaping of Output CWE-117: Improper Output Neutralization for Logs •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2023-43082
https://notcve.org/view.php?id=CVE-2023-43082
Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component. If a customer has a certificate signed by a third-party public Certificate Authority, the vCenter CA could be spoofed by an attacker who can obtain a CA-signed certificate. Dell Unity anterior a 5.3 contiene una vulnerabilidad de tipo "man in the middle" en el componente vmadapter. Si un cliente tiene un certificado firmado por una autoridad de certificación pública de terceros, un atacante podría falsificar la CA de vCenter y obtener un certificado firmado por una CA. • https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-43067
https://notcve.org/view.php?id=CVE-2023-43067
Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability. An XXE attack could potentially exploit this vulnerability disclosing local files in the file system. Dell Unity anterior a 5.3 contiene una vulnerabilidad de inyección de External Entity XML. Un ataque XXE podría explotar esta vulnerabilidad y revelar archivos locales en el sistema de archivos. • https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2023-43066
https://notcve.org/view.php?id=CVE-2023-43066
Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability. This could allow an authenticated, local attacker to exploit this vulnerability by authenticating to the device CLI and issuing certain commands. Dell Unity anterior a 5.3 contiene una vulnerabilidad de omisión de Shell restringido. Esto podría permitir que un atacante local autenticado aproveche esta vulnerabilidad autenticándose en el CLI del dispositivo y emitiendo ciertos comandos. • https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-43065
https://notcve.org/view.php?id=CVE-2023-43065
Dell Unity prior to 5.3 contains a Cross-site scripting vulnerability. A low-privileged authenticated attacker can exploit these issues to obtain escalated privileges. Dell Unity anterior a 5.3 contiene una vulnerabilidad de Cross-Site Scripting. Un atacante autenticado con pocos privilegios puede aprovechar estos problemas para obtener privilegios aumentados. • https://www.dell.com/support/kbdoc/en-us/000213152/dsa-2023-141-dell-unity-unity-vsa-and-unity-xt-security-update-for-multiple-vulnerabilities • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •