Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-3723 State: PUBLISHED Published: 2019-06-06T19:14:38.463575Z Last Updated: 2024-09-16T19:05:23.583Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell EMC Products: OpenManage Server Administrator Problem Types: Web Parameter Tampering Vulnerability Description: Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauthenticated attacker could potentially manipulate parameters of web requests to OMSA to create arbitrary files with empty content or delete the contents of any existing file, due to improper input parameter validation Additio
files with empty content or delete the contents of any existing file, due to improper input parameter validation Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln317441/dsa-2019-074-dell-emc-openmanage-server-administrator-multiple-vulnerabilities?lang=en - http://www.securityfocus.com/bid/108685
CVE ID: CVE-2019-3724 State: PUBLISHED Published: 2019-05-15T15:45:11.690012Z Last Updated: 2024-09-16T22:51:53.424Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: RSA Products: RSA Netwitness Platform Problem Types: Authorization Bypass Vulnerability Description: RSA Netwitness Platform versions prior to 11.2.1.1 is vulnerable to an Authorization Bypass vulnerability. A remote low privileged attacker could potentially exploit this vulnerability to gain access to administrative information including credentials. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-104202
CVE ID: CVE-2019-3725 State: PUBLISHED Published: 2019-05-15T15:45:11.741219Z Last Updated: 2024-09-16T19:01:43.913Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: RSA Products: RSA Netwitness Platform, RSA Security Analytics Problem Types: Command Injection vulnerability Description: RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnerability due to missing input validation in the product. A remote unauthenticated malicious user could exploit this vulnerability to execute arbitrary commands on the server. Additional Analyst Notes: - CVE Program Container: Ref
t this vulnerability to execute arbitrary commands on the server. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-104202 - http://www.securityfocus.com/bid/108355
CVE ID: CVE-2019-3726 State: PUBLISHED Published: 2019-09-24T15:31:31.400660Z Last Updated: 2024-09-16T17:58:10.848Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell EMC, Dell Products: Dell EMC Servers: Networking and Fibre Channel Drivers: Dell Update Package (DUP) Framework file, Dell EMC Servers: all other Drivers, BIOS and Firmware: Dell Update Package (DUP) Framework file, Dell Client Platforms: Dell Update Packages (DUP) Framework file Problem Types: Uncontrolled Search Path Vulnerability Description: An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and
Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework file versions prior to 103.4.6.69 used in Dell EMC Servers. Dell Update Package (DUP) Framework file versions prior to 3.8.3.67 used in Dell Client Platforms. The vulnerability is limited to the DUP framework during the time window when a DUP is being executed by an administrator. During this time window, a locally authenticated low privilege malicious user potentially could exploit this vulnerability by tricking an administrator into running a trusted binary, causing it to load a malicious DLL and allowing the attacker to execute arbitrary code on the victim sys
trusted binary, causing it to load a malicious DLL and allowing the attacker to execute arbitrary code on the victim system. The vulnerability does not affect the actual binary payload that the DUP delivers. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN318693
CVE ID: CVE-2019-3727 State: PUBLISHED Published: 2019-05-15T15:45:11.817065Z Last Updated: 2024-09-17T03:42:56.299Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: RecoverPoint Problem Types: OS command injection vulnerability Description: Dell EMC RecoverPoint versions prior to 5.1.3 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an OS command injection vulnerability in the installation feature of Boxmgmt CLI. A malicious boxmgmt user may potentially be able to execute arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/us/en/04/details/533842/DSA-
Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/us/en/04/details/533842/DSA-2019-078-Dell-EMC-RecoverPoint-OS-Command-Injection-Vulnerability - http://www.securityfocus.com/bid/108411
CVE ID: CVE-2019-3728 State: PUBLISHED Published: 2019-09-30T21:48:40.164Z Last Updated: 2025-11-04T21:08:09.233Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: RSA BSAFE Crypto-C Micro Edition, RSA BSAFE Micro Edition Suite, RSA Crypto-C Problem Types: CWE-125 Description: RSA BSAFE Crypto-C Micro Edition versions from 4.0.0.0 before 4.0.5.4 and from 4.1.0 before 4.1.4, RSA BSAFE Micro Edition Suite versions from 4.0.0 before 4.0.13 and from 4.1.0 before 4.4 and RSA Crypto-C versions from 6.0.0 through 6.4.* are vulnerable to an out-of-bounds read vulnerability when processing DSA signature. A malicious remote user could potentially exploit th
an out-of-bounds read vulnerability when processing DSA signature. A malicious remote user could potentially exploit this vulnerability to cause a crash in the library of the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000194054
CVE ID: CVE-2019-3729 State: PUBLISHED Published: 2019-09-30T21:48:40.208416Z Last Updated: 2024-09-16T23:26:51.910Z Severity: LOW (CVSS 2.4 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: RSA BSAFE MES Problem Types: CWE-121 Description: RSA BSAFE Micro Edition Suite versions prior to 4.4 (in 4.0.x, 4.1.x, 4.2.x and 4.3.x) are vulnerable to a Heap-based Buffer Overflow vulnerability when parsing ECDSA signature. A malicious user with adjacent network access could potentially exploit this vulnerability to cause a crash in the library of the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000194054
CVE ID: CVE-2019-3730 State: PUBLISHED Published: 2019-09-30T21:48:40.255331Z Last Updated: 2024-09-16T21:08:24.697Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: RSA BSAFE MES Problem Types: CWE-649 Description: RSA BSAFE Micro Edition Suite versions prior to 4.1.6.3 (in 4.1.x) and prior to 4.4 (in 4.2.x and 4.3.x), are vulnerable to an Information Exposure Through an Error Message vulnerability, also known as a “padding oracle attack vulnerability”. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure. Additional Analyst Notes: - CVE Program Container: References: - ht
xtract information leaving data at risk of exposure. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000194054
CVE ID: CVE-2019-3731 State: PUBLISHED Published: 2019-09-30T21:48:40.294314Z Last Updated: 2024-09-16T23:56:35.629Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: RSA BSAFE Crypto-C Micro Edition, RSA BSAFE MES Problem Types: CWE-310 Description: RSA BSAFE Crypto-C Micro Edition versions prior to 4.1.4 and RSA Micro Edition Suite versions prior to 4.4 are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc
at risk of exposure. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000194054
CVE ID: CVE-2019-3732 State: PUBLISHED Published: 2019-09-30T21:48:40.337065Z Last Updated: 2024-09-16T16:37:45.300Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: RSA BSAFE Crypto-C Micro Edition, RSA BSAFE MES Problem Types: CWE-385 Description: RSA BSAFE Crypto-C Micro Edition, versions prior to 4.0.5.3 (in 4.0.x) and versions prior to 4.1.3.3 (in 4.1.x), and RSA Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) versions prior to 4.1.6.1 (in 4.1.x) and versions prior to 4.3.3 (4.2.x and 4.3.x) are vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to
Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000194054
CVE ID: CVE-2019-3733 State: PUBLISHED Published: 2019-09-30T21:48:40.378291Z Last Updated: 2024-09-16T23:20:53.121Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: RSA BSAFE Crypto-C Micro Edition, RSA BSAFE MES Problem Types: CWE-316 Description: RSA BSAFE Crypto-C Micro Edition, all versions prior to 4.1.4, is vulnerable to three (3) different Improper Clearing of Heap Memory Before Release vulnerability, also known as 'Heap Inspection vulnerability'. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure. Additional Analyst Notes: - CVE Program Container: References: - h
extract information leaving data at risk of exposure. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000194054
CVE ID: CVE-2019-3734 State: PUBLISHED Published: 2019-07-18T15:47:00.111450Z Last Updated: 2024-09-16T20:27:42.264Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: DELL EMC Products: Unity Problem Types: Improper Authorization Vulnerability Description: Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuration. A remote authenticated Unisphere Operator could potentially exploit this vulnerability to edit quota configuration of other users. Additional Analyst Notes: - CVE Program Container: References: - https://productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en
st Notes: - CVE Program Container: References: - https://productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en/04/details/535028/DSA-2019-086-Dell-EMC-Unity-Family-Multiple-Vulnerabilities
CVE ID: CVE-2019-3735 State: PUBLISHED Published: 2019-06-20T21:43:26.331005Z Last Updated: 2024-09-17T00:12:00.256Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell SupportAssist for Business PCs, Dell SupportAssist for Home PCs Problem Types: Improper Privilege Management Vulnerability Description: Dell SupportAssist for Business PCs version 2.0 and Dell SupportAssist for Home PCs version 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, and 3.2.1 contain an Improper Privilege Management Vulnerability. A malicious local user can exploit this vulnerability by inheriting a system thread using a leaked thread handle to gain system privileg
l user can exploit this vulnerability by inheriting a system thread using a leaked thread handle to gain system privileges on the affected machine. Additional Analyst Notes: - CVE Program Container: References: - http://www.dell.com/support/article/sln317453
CVE ID: CVE-2019-3736 State: PUBLISHED Published: 2019-09-27T20:19:45.429008Z Last Updated: 2024-09-17T04:10:25.001Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: Integrated Data Protection Appliance Problem Types: CWE-257 Description: Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malicious user with root privileges may potentially use a support tool to decrypt encrypted passwords stored locally on the system to use it to access other components using the privileges of the compromised user. Additional Analyst Notes: - CVE Program Contain
to access other components using the privileges of the compromised user. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/536363/DSA-2019-112-Dell-EMC-Integrated-Data-Protection-Appliance-Multiple-Vulnerabilities
CVE ID: CVE-2019-3737 State: PUBLISHED Published: 2019-06-19T22:28:07.263370Z Last Updated: 2024-09-16T19:50:59.459Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell EMC Products: Avamar Problem Types: CWE-22 Description: Dell EMC Avamar ADMe Web Interface 1.0.50 and 1.0.51 are affected by an LFI vulnerability which may allow a malicious user to download arbitrary files from the affected system by sending a specially crafted request to the Web Interface application. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2019/Jun/25
CVE ID: CVE-2019-3738 State: PUBLISHED Published: 2019-09-18T22:23:10.057919Z Last Updated: 2024-09-16T19:01:44.507Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Dell Products: RSA BSAFE Crypto-J Problem Types: CWE-325 Description: RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.dell.com/support/security/en-us/details/
erences: - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities - https://www.oracle.com/security-alerts/cpuoct2020.html - https://kc.mcafee.com/corporate/index?page=content&id=SB10318 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2019-3739 State: PUBLISHED Published: 2019-09-18T22:23:10.098836Z Last Updated: 2024-09-16T17:43:20.591Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Dell Products: RSA BSAFE Crypto-J Problem Types: CWE-310 Description: RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.dell.com/support/security/en-us/details/DOC-
ces: - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2019-3740 State: PUBLISHED Published: 2019-09-18T22:23:10.138468Z Last Updated: 2024-09-17T01:40:53.233Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Dell Products: RSA BSAFE Crypto-J Problem Types: CWE-310 Description: RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.dell.com/support/security/en-us/details/DOC-1
es: - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.dell.com/support/security/en-us/details/DOC-106556/DSA-2019-094-RSA-BSAFE&#174%3B-Crypto-J-Multiple-Security-Vulnerabilities - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2019-3741 State: PUBLISHED Published: 2019-07-18T15:47:00.171821Z Last Updated: 2024-09-16T19:29:55.995Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: DELL EMC Products: Unity Problem Types: Plain-text Password Storage Vulnerability Description: Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s (including the admin privilege user) password is stored in a plain text in Unity Data Collection bundle (logs files for troubleshooting). A local authenticated attacker with access to the Data Collection bundle may use the exposed password to gain access with the privileges o
ted attacker with access to the Data Collection bundle may use the exposed password to gain access with the privileges of the compromised user. Additional Analyst Notes: - CVE Program Container: References: - https://productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en/04/details/535028/DSA-2019-086-Dell-EMC-Unity-Family-Multiple-Vulnerabilities
CVE ID: CVE-2019-3742 State: PUBLISHED Published: 2019-08-09T19:12:42.990012Z Last Updated: 2024-09-17T00:45:47.967Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Digital Delivery, Alienware Digital Delivery Problem Types: Privilege Escalation Vulnerability Description: Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges. Additional Analyst Notes: - CVE Program Container: References:
cous code to run an executable with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN318085
CVE ID: CVE-2019-3744 State: PUBLISHED Published: 2019-08-09T19:13:37.161272Z Last Updated: 2024-09-16T17:08:58.233Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Digital Delivery, Alienware Digital Delivery Problem Types: Privilege Escalation Vulnerability Description: Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges. Additional
race condition and a path traversal exploit in order to run a malicious executable with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN318085
CVE ID: CVE-2019-3745 State: PUBLISHED Published: 2019-10-07T18:21:30.854483Z Last Updated: 2024-09-17T04:14:02.203Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Encryption Enterprise, Dell Endpoint Security Suite Enterprise Problem Types: CWE-427 Description: The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prior to 2.4.0. This issue is exploitable only during the installation of the product by an administrator. A local authenticated low privileged user potentially could exploit this vulnerability by staging a malicious DLL in the
A local authenticated low privileged user potentially could exploit this vulnerability by staging a malicious DLL in the search path of the installer prior to its execution by a local administrator. This would cause loading of the malicious DLL, which would allow the attacker to execute arbitrary code in the context of an administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN318889
CVE ID: CVE-2019-3746 State: PUBLISHED Published: 2019-09-27T20:20:39.666422Z Last Updated: 2024-09-17T01:36:45.790Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Integrated Data Protection Appliance Problem Types: CWE-307 Description: Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts to the ACM API. An authenticated remote user may exploit this vulnerability to launch a brute-force authentication attack in order to gain access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/536363/DSA-201
Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/536363/DSA-2019-112-Dell-EMC-Integrated-Data-Protection-Appliance-Multiple-Vulnerabilities
CVE ID: CVE-2019-3747 State: PUBLISHED Published: 2019-09-27T20:21:21.014325Z Last Updated: 2024-09-17T00:26:31.837Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Dell Products: Integrated Data Protection Appliance Problem Types: CWE-79 Description: Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability. A remote malicious ACM admin user may potentially exploit this vulnerability to store malicious HTML or JavaScript code in Cloud DR add-on specific field. When victim users access the page through their browsers, the malicious code gets executed by the web browser in the context of the vulnerab
cess the page through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/536363/DSA-2019-112-Dell-EMC-Integrated-Data-Protection-Appliance-Multiple-Vulnerabilities
CVE ID: CVE-2019-3749 State: PUBLISHED Published: 2019-12-03T20:20:16.387402Z Last Updated: 2024-09-17T01:51:02.139Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H) Vendors: Dell Products: Dell Command Update (DCU) Problem Types: CWE-427 Description: Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentially could exploit this vulnerability to delete arbitrary files by creating a symlink from the "Temp\ICProgress\Dell_InventoryCollector_Progress.xml" to any targeted file. This issue occurs because permissions on the Temp directory were set incorrectly. Additional Ana