dell Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/dell/ Sun, 26 Feb 2023 06:42:18 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png dell Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/dell/ 32 32 CVE-2020-5362 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-5362/ Sun, 26 Feb 2023 06:42:18 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-5362/ Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized actor, with local system access with OS administrator privileges, could bypass the BIOS Administrator authentication to restore BIOS Setup configuration to default values.

The post CVE-2020-5362 appeared first on CVE Vulnerability.

]]> Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized actor, with local system access with OS administrator privileges, could bypass the BIOS Administrator authentication to restore BIOS Setup configuration to default values.

The post CVE-2020-5362 appeared first on CVE Vulnerability.

]]> CVE-2020-5348 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-5348/ Sun, 26 Feb 2023 06:42:17 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-5348/ Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI_BOOT_SERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFI_BOOT_SERVICES structure to execute arbitrary code in system management mode.

The post CVE-2020-5348 appeared first on CVE Vulnerability.

]]> Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI_BOOT_SERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFI_BOOT_SERVICES structure to execute arbitrary code in system management mode.

The post CVE-2020-5348 appeared first on CVE Vulnerability.

]]> CVE-2020-5326 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-5326/ Sun, 26 Feb 2023 06:42:17 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-5326/ Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the […]

The post CVE-2020-5326 appeared first on CVE Vulnerability.

]]> Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager.

The post CVE-2020-5326 appeared first on CVE Vulnerability.

]]> CVE-2020-5324 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-5324/ Sun, 26 Feb 2023 06:42:17 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-5324/ Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via […]

The post CVE-2020-5324 appeared first on CVE Vulnerability.

]]> Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers.

The post CVE-2020-5324 appeared first on CVE Vulnerability.

]]> CVE-2020-29492 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-29492/ Sun, 26 Feb 2023 06:40:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-29492/ Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to access the writable file and manipulate the configuration of any target specific station.

The post CVE-2020-29492 appeared first on CVE Vulnerability.

]]> Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to access the writable file and manipulate the configuration of any target specific station.

The post CVE-2020-29492 appeared first on CVE Vulnerability.

]]> CVE-2020-29491 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-29491/ Sun, 26 Feb 2023 06:40:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-29491/ Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the sensitive information on the local network, leading to the potential compromise of impacted thin clients.

The post CVE-2020-29491 appeared first on CVE Vulnerability.

]]> Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the sensitive information on the local network, leading to the potential compromise of impacted thin clients.

The post CVE-2020-29491 appeared first on CVE Vulnerability.

]]> CVE-2019-3754 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3754/ Sun, 26 Feb 2023 06:33:13 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3754/ Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java […]

The post CVE-2019-3754 appeared first on CVE Vulnerability.

]]> Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser.

The post CVE-2019-3754 appeared first on CVE Vulnerability.

]]> CVE-2019-3753 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3753/ Sun, 26 Feb 2023 06:33:13 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3753/ Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACSRadius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the system settings menu may obtain the exposed password to use it in further […]

The post CVE-2019-3753 appeared first on CVE Vulnerability.

]]> Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerability. TACACSRadius credentials are stored in plain text in the system settings menu. An authenticated malicious user with access to the system settings menu may obtain the exposed password to use it in further attacks.

The post CVE-2019-3753 appeared first on CVE Vulnerability.

]]> CVE-2019-3747 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3747/ Sun, 26 Feb 2023 06:33:13 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3747/ Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users access the page through their browsers, the malicious code gets executed by […]

The post CVE-2019-3747 appeared first on CVE Vulnerability.

]]> Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users access the page through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.

The post CVE-2019-3747 appeared first on CVE Vulnerability.

]]> CVE-2019-3746 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3746/ Sun, 26 Feb 2023 06:33:13 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3746/ Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system.

The post CVE-2019-3746 appeared first on CVE Vulnerability.

]]> Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system.

The post CVE-2019-3746 appeared first on CVE Vulnerability.

]]>