Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
raproject.org/message/J4AMYYHGBYMIWCCR5RCDFI5RAUJOPO5L/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HM7U5JNS5WU66Q3S26PFIU2ITB2ATTQ4/ - https://www.oracle.com/security-alerts/cpujan2022.html - https://groups.google.com/g/golang-announce/c/uHACNfXAZqk - https://lists.debian.org/debian-lts-announce/2022/01/msg00016.html - https://lists.debian.org/debian-lts-announce/2022/01/msg00017.html - https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf - https://security.gentoo.org/glsa/202208-02 - https://lis
ttps://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf - https://security.gentoo.org/glsa/202208-02 - https://lists.debian.org/debian-lts-announce/2023/04/msg00021.html
CVE ID: CVE-2021-36222 State: PUBLISHED Published: 2021-07-22T17:28:47 Last Updated: 2024-08-04T00:54:51.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation. Additional Analyst Notes: - CVE Program Container: References: - https://web.mit.edu/kerberos/advisories/ - https://github.com/krb5/krb5/releases - https://www.debian.org/security/2021/dsa-4944 - https://www.oracle.com/security-ale
ps://github.com/krb5/krb5/releases - https://www.debian.org/security/2021/dsa-4944 - https://www.oracle.com/security-alerts/cpuoct2021.html - https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562 - https://security.netapp.com/advisory/ntap-20211022-0003/ - https://security.netapp.com/advisory/ntap-20211104-0007/
CVE ID: CVE-2021-36224 State: PUBLISHED Published: 2023-02-06T00:00:00 Last Updated: 2024-08-04T00:54:50.819Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital My Cloud devices before OS5 have a nobody account with a blank password. Additional Analyst Notes: - CVE Program Container: References: - https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/ - https://www.youtube.com/watch?v=vsg9YgvGBec - https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
CVE ID: CVE-2021-36225 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T18:39:27.824Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital My Cloud devices before OS5 allow REST API access by low-privileged accounts, as demonstrated by API commands for firmware uploads and installation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/ - https://www.youtube.com/watch?v=vsg9YgvGBec - https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
CVE ID: CVE-2021-36226 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-26T18:39:10.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://krebsonsecurity.com/2021/07/another-0-day-looms-for-many-western-digital-users/ - https://www.youtube.com/watch?v=vsg9YgvGBec - https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/weekend_destroyer/weekend_destroyer.md
CVE ID: CVE-2021-36230 State: PUBLISHED Published: 2021-07-20T20:53:26 Last Updated: 2024-08-04T00:54:50.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/terraform/ - https://discuss.hashicorp.com/t/hcsec-2021-18-terraform-enterprise-allowed-privilege-escalation-via-run-token/27070
CVE ID: CVE-2021-36231 State: PUBLISHED Published: 2021-08-31T17:41:20 Last Updated: 2024-08-04T00:54:51.226Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attackers to execute operating system commands by crafting serialized objects. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-035.txt
CVE ID: CVE-2021-36232 State: PUBLISHED Published: 2021-08-31T17:37:53 Last Updated: 2024-08-04T00:54:51.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-036.txt
CVE ID: CVE-2021-36233 State: PUBLISHED Published: 2021-08-31T17:50:00 Last Updated: 2024-08-04T00:54:50.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacker to read arbitrary files from the filesystem by specifying the file path. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-037.txt
CVE ID: CVE-2021-36234 State: PUBLISHED Published: 2021-08-31T17:45:38 Last Updated: 2024-08-04T00:54:51.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-039.txt
CVE ID: CVE-2021-36235 State: PUBLISHED Published: 2021-09-01T00:19:28 Last Updated: 2024-08-04T00:54:50.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the attacker can start applications with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-bypass-the-File-and-Folder-Security-by-leveraging-an-unspecified-attack-vector
CVE ID: CVE-2021-36260 State: PUBLISHED Published: 2021-09-22T12:07:55.000Z Last Updated: 2025-10-21T23:25:31.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/ - http://packetstormsecurity.com/files
security-notification-command-injection-vulnerability-in-some-hikvision-products/ - http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html - http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html - https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf - https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/
CVE ID: CVE-2021-36276 State: PUBLISHED Published: 2021-08-09T21:05:33.040034Z Last Updated: 2024-09-17T02:42:58.797Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: dbutil Problem Types: CWE-285 Description: Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000190105/dsa-2021-152-dell-client-platform-security-update-for-an-insufficient-access-control-vuln
/support/kbdoc/en-us/000190105/dsa-2021-152-dell-client-platform-security-update-for-an-insufficient-access-control-vulnerability-in-the-dell-dbutildrv2-sys-driver
CVE ID: CVE-2021-36277 State: PUBLISHED Published: 2021-08-09T21:05:34.537403Z Last Updated: 2024-09-17T03:59:48.037Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Alienware Command Center (AWCC) Problem Types: CWE-347 Description: Dell Command | Update, Dell Update, and Alienware Update versions before 4.3 contains an Improper Verification of Cryptographic Signature Vulnerability. A local authenticated malicious user may exploit this vulnerability by executing arbitrary code on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000190110
CVE ID: CVE-2021-36278 State: PUBLISHED Published: 2021-08-16T22:00:29.902418Z Last Updated: 2024-09-17T03:03:09.906Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-532 Description: Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files. A local malicious user with ISI_PRIV_LOGIN_SSH, ISI_PRIV_LOGIN_CONSOLE, or ISI_PRIV_SYS_SUPPORT privileges may exploit this vulnerability to access sensitive information. If any third-party consumes those logs, the same sensitive information is available to those systems as well. Additional Analyst No
d-party consumes those logs, the same sensitive information is available to those systems as well. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000190408
CVE ID: CVE-2021-36279 State: PUBLISHED Published: 2021-08-16T22:00:31.572502Z Last Updated: 2024-09-16T23:05:55.859Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-732 Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE to access privileged information about the cluster. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000190408
CVE ID: CVE-2021-36280 State: PUBLISHED Published: 2021-08-16T22:00:33.151445Z Last Updated: 2024-09-16T22:56:08.317Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: CWE-732 Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE to access privileged information about the cluster. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000190408
CVE ID: CVE-2021-36281 State: PUBLISHED Published: 2021-08-16T22:00:34.701461Z Last Updated: 2024-09-17T00:40:51.655Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: PowerScale OneFS Problem Types: Other Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment vulnerability. A low privileged authenticated user can potentially exploit this vulnerability to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000190408
CVE ID: CVE-2021-36282 State: PUBLISHED Published: 2021-08-16T22:00:36.320687Z Last Updated: 2024-09-17T04:29:34.182Z Severity: LOW (CVSS 2.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: PowerScale OneFS Problem Types: Other Description: Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. This can potentially allow an authenticated user with ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH privileges to gain access up to 24 bytes of data within the /ifs kernel stack under certain conditions. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000190408
CVE ID: CVE-2021-36283 State: PUBLISHED Published: 2021-09-28T19:20:22.857479Z Last Updated: 2024-09-16T16:58:48.425Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-20 Description: Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000191495/
CVE ID: CVE-2021-36284 State: PUBLISHED Published: 2021-09-28T19:20:24.352335Z Last Updated: 2024-09-17T02:20:32.730Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Dell Products: CPG BIOS Problem Types: CWE-307 Description: Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive admin password attempt mitigations in order to carry out a brute force attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000191495
CVE ID: CVE-2021-36285 State: PUBLISHED Published: 2021-09-28T19:20:25.870057Z Last Updated: 2024-09-17T03:37:29.343Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: Dell Products: CPG BIOS Problem Types: CWE-307 Description: Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000191495/
CVE ID: CVE-2021-36286 State: PUBLISHED Published: 2021-09-28T19:20:27.407420Z Last Updated: 2024-09-16T19:25:15.640Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: SupportAssist Client Consumer Problem Types: CWE-22 Description: Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited by using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by any(non-privileged) user under some object directories, but by themselves are not sufficient to successfully escalate privileges. However, combining them with a different
ries, but by themselves are not sufficient to successfully escalate privileges. However, combining them with a different object, such as the NTFS junction point allows for the exploitation. Support assist clean files functionality do not distinguish junction points from the physical folder and proceeds to clean the target of the junction that allows nonprivileged users to create junction points and delete arbitrary files on the system which can be accessed only by the admin. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities
CVE ID: CVE-2021-36287 State: PUBLISHED Published: 2022-04-08T19:50:21.612336Z Last Updated: 2024-09-16T17:53:47.957Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Dell Products: VNX2 Problem Types: CWE-78 Description: Dell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticated users to execute commands on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2021-36288 State: PUBLISHED Published: 2022-04-08T19:50:23.145596Z Last Updated: 2024-09-16T17:32:57.568Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Dell Products: VNX2 Problem Types: CWE-22 Description: Dell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead unauthenticated users to read/write restricted files Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2021-36289 State: PUBLISHED Published: 2022-01-25T22:15:19.659371Z Last Updated: 2024-09-17T01:50:57.134Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: VNX Control Station Problem Types: CWE-532 Description: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2021-36290 State: PUBLISHED Published: 2022-04-08T19:50:24.561131Z Last Updated: 2024-09-16T16:53:42.840Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: VNX2 Problem Types: CWE-732 Description: Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability and gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2021-36293 State: PUBLISHED Published: 2022-04-08T19:50:26.071028Z Last Updated: 2024-09-17T01:10:59.295Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: VNX2 Problem Types: CWE-78 Description: Dell VNX2 for File version 8.1.21.266 and earlier, contain a privilege escalation vulnerability. A local malicious admin may potentially exploit vulnerability and gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2021-36294 State: PUBLISHED Published: 2022-01-25T22:15:21.100927Z Last Updated: 2024-09-16T16:22:50.056Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: VNX Control Station Problem Types: CWE-331 Description: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulnerability by forging a cookie to login as any user. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2021-36295 State: PUBLISHED Published: 2022-01-25T22:15:22.477767Z Last Updated: 2024-09-17T03:53:42.290Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: VNX Control Station Problem Types: CWE-78 Description: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2021-36296 State: PUBLISHED Published: 2022-01-25T22:15:23.857983Z Last Updated: 2024-09-16T20:38:13.176Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: VNX Control Station Problem Types: CWE-78 Description: Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authenticated remote code execution vulnerability. A remote malicious user with privileges may exploit this vulnerability to execute commands on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities
CVE ID: CVE-2021-36297 State: PUBLISHED Published: 2021-09-28T19:20:28.930601Z Last Updated: 2024-09-16T20:38:07.749Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: SupportAssist Client Consumer Problem Types: CWE-426 Description: SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting/hijacking, only by a separate administrative action that is not a default part of the SOSInstallerTool.exe installation for executing arbitrary dll's, Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/0001
ry dll's, Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities
CVE ID: CVE-2021-36298 State: PUBLISHED Published: 2021-10-01T20:20:58.300366Z Last Updated: 2024-09-17T02:36:40.755Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Isilon InsightIQ Problem Types: CWE-327 Description: Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to authentication bypass and remote takeover of the InsightIQ. This allows an attacker to take complete control of InsightIQ to affect services provided by SSH; so Dell recommends customers to upgrade at the earliest opportunity. Additional
tIQ to affect services provided by SSH; so Dell recommends customers to upgrade at the earliest opportunity. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/000191604
CVE ID: CVE-2021-36299 State: PUBLISHED Published: 2021-11-23T20:00:31.814994Z Last Updated: 2024-09-16T23:36:38.390Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: Dell Products: Integrated Dell Remote Access Controller (iDRAC) Problem Types: CWE-89 Description: Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application. Additional Analyst Notes: - CVE Program Container: Refer
lying specially crafted input data to the affected application. Additional Analyst Notes: - CVE Program Container: References: - https://support.emc.com/kb/000191229