Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-5301 State: PUBLISHED Published: 2020-04-21T19:50:13 Last Updated: 2024-08-04T08:22:09.096Z Severity: LOW (CVSS 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: simplesamlphp Products: simplesamlphp Problem Types: CWE-200 Description: SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that processes requests for pages hosted by modules, has code to identify paths ending with `.php` and process those as PHP code. If no other suitable way of handling the given path exists it presents the file to the browser. The check to identify paths ending with `.php` does not account for uppercase lette
it presents the file to the browser. The check to identify paths ending with `.php` does not account for uppercase letters. If someone requests a path ending with e.g. `.PHP` and the server is serving the code from a case-insensitive file system, such as on Windows, the processing of the PHP code does not occur, and the source code is instead presented to the browser. An attacker may use this issue to gain access to the source code in third-party modules that is meant to be private, or even sensitive. However, the attack surface is considered small, as the attack will only work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. This issu
work when SimpleSAMLphp serves such content from a file system that is not case-sensitive, such as on Windows. This issue is fixed in version 1.18.6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-24m3-w8g9-jwpq - https://github.com/simplesamlphp/simplesamlphp/commit/47968d26a2fd3ed52da70dc09210921d612ce44e
CVE ID: CVE-2020-5302 State: PUBLISHED Published: 2020-04-07T15:40:14 Last Updated: 2024-08-04T08:22:09.088Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: examknow Products: MH-WikiBot Problem Types: CWE-284 Description: MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface by impersonating the Nickname used by a privileged user as no check was made to see if they were logged in. The issue has been fixed in commit 23d9d5b0a59667a5d6816fdabb960b537a5f9ed1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/examknow/MH-Wiki
dabb960b537a5f9ed1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/examknow/MH-WikiBot/security/advisories/GHSA-7hf3-wvp8-34r9 - https://github.com/examknow/MH-WikiBot/compare/2eac90d...1a62da1
CVE ID: CVE-2020-5303 State: PUBLISHED Published: 2020-04-10T18:30:15 Last Updated: 2024-08-04T08:22:09.074Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: Tendermint Products: Tendermint Problem Types: CWE-789 Description: Tendermint before versions 0.33.3, 0.32.10, and 0.31.12 has a denial-of-service vulnerability. Tendermint does not limit the number of P2P connection requests. For each p2p connection, it allocates XXX bytes. Even though this memory is garbage collected once the connection is terminated (due to duplicate IP or reaching a maximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions. Additionally, Tende
aximum number of inbound peers), temporary memory spikes can lead to OOM (Out-Of-Memory) exceptions. Additionally, Tendermint does not reclaim activeID of a peer after it's removed in Mempool reactor. This does not happen all the time. It only happens when a connection fails (for any reason) before the Peer is created and added to all reactors. RemovePeer is therefore called before AddPeer, which leads to always growing memory (activeIDs map). The activeIDs map has a maximum size of 65535 and the node will panic if this map reaches the maximum. An attacker can create a lot of connection attempts (exploiting above denial of service), which ultimately will lead to the node panicking. These iss
of connection attempts (exploiting above denial of service), which ultimately will lead to the node panicking. These issues are patched in Tendermint 0.33.3 and 0.32.10. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tendermint/tendermint/security/advisories/GHSA-v24h-pjjv-mcp6 - https://hackerone.com/reports/820317 - https://github.com/tendermint/tendermint/commit/e2d6859afd7dba4cf97c7f7d412e7d8fc908d1cd
CVE ID: CVE-2020-5304 State: PUBLISHED Published: 2020-06-08T16:12:06 Last Updated: 2024-08-04T08:22:09.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dashboard in WhiteSource Application Vulnerability Management (AVM) before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter to the /saml/login URI. This closes the current log and creates a new log with one line of data. The attacker can also insert malicious data and false entries. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/oss_security_vulnerabilities/ - https://medium.com/%40venkatajayaram.yalla/whitesource-log-injection-vulnerabili
are.com/oss_security_vulnerabilities/ - https://medium.com/%40venkatajayaram.yalla/whitesource-log-injection-vulnerability-cve-2020-5304-e543b7943c2b
CVE ID: CVE-2020-5305 State: PUBLISHED Published: 2020-01-05T22:26:39 Last Updated: 2024-08-04T08:22:09.254Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen. Additional Analyst Notes: - CVE Program Container: References: - http://codologic.com/forum/index.php?u=/category/news-and-announcements - https://vyshnavvizz.blogspot.com/2020/01/stored-cross-site-scripting-in_2.html
CVE ID: CVE-2020-5306 State: PUBLISHED Published: 2020-01-05T22:32:54 Last Updated: 2024-08-04T08:22:09.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content. Additional Analyst Notes: - CVE Program Container: References: - http://codologic.com/forum/index.php?u=/category/news-and-announcements - https://vyshnavvizz.blogspot.com/2020/01/stored-cross-site-scripting-in.html - https://www.exploit-db.com/exploits/47886
CVE ID: CVE-2020-5307 State: PUBLISHED Published: 2020-01-07T18:58:33 Last Updated: 2024-08-04T08:22:09.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in add-product.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/47846 - https://cinzinga.github.io/CVE-2020-5307-5308/
CVE ID: CVE-2020-5308 State: PUBLISHED Published: 2020-01-09T12:15:18 Last Updated: 2024-08-04T08:22:09.091Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName parameter in add-product.php. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/ - http://packetstormsecurity.com/files/155861/Dairy-Farm-Shop-Management-System-1.0-Cross-Site-Scripting.html - https://cinzinga.github.io/CV
ecurity.com/files/155861/Dairy-Farm-Shop-Management-System-1.0-Cross-Site-Scripting.html - https://cinzinga.github.io/CVE-2020-5307-5308/
CVE ID: CVE-2020-5310 State: PUBLISHED Published: 2020-01-03T00:52:55 Last Updated: 2024-08-04T08:22:09.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html - https://github.com/python-pillow/Pillow/commit/4e2def2539ec13e53a82e06c4b3daf00454100c4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/ - https://usn.ubuntu.com/4272-1/ - https://lists.fedoraproject.org/archives
rg/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/ - https://usn.ubuntu.com/4272-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/
CVE ID: CVE-2020-5311 State: PUBLISHED Published: 2020-01-03T00:52:42 Last Updated: 2024-08-04T08:22:09.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html - https://github.com/python-pillow/Pillow/commit/a79b65c47c7dc6fe623aadf09aa6192fc54548f3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/ - https://usn.ubuntu.com/4272-1/ - https://access.redhat.com/errata/RHSA-2020:0566 - https://lists.fedo
PKKC2WZA7UIIQ3A/ - https://usn.ubuntu.com/4272-1/ - https://access.redhat.com/errata/RHSA-2020:0566 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/ - https://www.debian.org/security/2020/dsa-4631 - https://access.redhat.com/errata/RHSA-2020:0580
CVE ID: CVE-2020-5312 State: PUBLISHED Published: 2020-01-03T00:52:34 Last Updated: 2024-08-04T08:22:09.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html - https://github.com/python-pillow/Pillow/commit/93b22b846e0269ee9594ff71a72bec02d2bea8fd - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/ - https://usn.ubuntu.com/4272-1/ - https://access.redhat.com/errata/RHSA-2020:0566 - https://lists.f
WHDPKKC2WZA7UIIQ3A/ - https://usn.ubuntu.com/4272-1/ - https://access.redhat.com/errata/RHSA-2020:0566 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/ - https://www.debian.org/security/2020/dsa-4631 - https://access.redhat.com/errata/RHSA-2020:0580 - https://access.redhat.com/errata/RHSA-2020:0578 - https://access.redhat.com/errata/RHSA-2020:0681 - https://access.redhat.com/errata/RHSA-2020:0683 - https://access.redhat.com/errata/RHSA-2020:0694
CVE ID: CVE-2020-5313 State: PUBLISHED Published: 2020-01-03T00:52:23 Last Updated: 2024-08-04T08:22:09.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://pillow.readthedocs.io/en/stable/releasenotes/6.2.2.html - https://github.com/python-pillow/Pillow/commit/a09acd0decd8a87ccce939d5ff65dab59e7d365b - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MMU3WT2X64GS5WHDPKKC2WZA7UIIQ3A/ - https://usn.ubuntu.com/4272-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.
C2WZA7UIIQ3A/ - https://usn.ubuntu.com/4272-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3DUMIBUYGJRAVJCTFUWBRLVQKOUTVX5P/ - https://www.debian.org/security/2020/dsa-4631
CVE ID: CVE-2020-5315 State: PUBLISHED Published: 2021-07-19T21:30:31.444529Z Last Updated: 2024-09-16T16:18:34.603Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: Dell EMC Repository Manager (DRM) Problem Types: CWE-256 Description: Dell EMC Repository Manager (DRM) version 3.2 contains a plain-text password storage vulnerability. Proxy server user password is stored in a plain text in a local database. A local authenticated malicious user with access to the local file system may use the exposed password to access the with privileges of the compromised user. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/
ivileges of the compromised user. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/us/en/04/sln319925/dsa-2020-001-dell-emc-repository-manager-drm-sensitive-data-exposure-vulnerability?lang=en
CVE ID: CVE-2020-5316 State: PUBLISHED Published: 2021-07-22T17:00:13.027568Z Last Updated: 2024-09-17T04:19:11.569Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell SupportAssist Client Problem Types: CWE-427 Description: Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, 3.2.1, 3.2.2, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.4 contain an uncontrolled search path vulnerability. A locally authenticated low privileged user could exploit this vulnerability to cause the loading
h path vulnerability. A locally authenticated low privileged user could exploit this vulnerability to cause the loading of arbitrary DLLs by the SupportAssist binaries, resulting in the privileged execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.dell.com/support/article/SLN320101
CVE ID: CVE-2020-5317 State: PUBLISHED Published: 2020-02-06T17:45:21.324979Z Last Updated: 2024-09-17T03:28:03.391Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N) Vendors: Dell Products: Elastic Cloud Storage Problem Types: CWE-79 Description: Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program Con
xecuted by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/540788/DSA-2020-016-Dell-EMC-ECS-Cross-Site-Scripting-XSS-Vulnerability
CVE ID: CVE-2020-5318 State: PUBLISHED Published: 2020-02-06T17:45:21.769450Z Last Updated: 2024-09-16T20:32:51.816Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: Isilon OneFS Problem Types: CWE-285 Description: Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability to gain access to restricted files. The non-RAN HTTP and WebDAV file-serving components have a vulnerability wherein when either are enabled, and Basic Authentication is enabled for either or both components, files are accessible without authentication. Additional Analyst Notes:
cation is enabled for either or both components, files are accessible without authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/540708/DSA-2020-018-Dell-EMC-Isilon-OneFS-Security-Update-for-Improper-Authorization-Vulnerability
CVE ID: CVE-2020-5319 State: PUBLISHED Published: 2020-02-06T17:45:22.225221Z Last Updated: 2024-09-16T20:27:11.870Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Dell Products: Unity Problem Types: CWE-129 Description: Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Server SSH implementation that is used to provide SFTP service on a NAS server. A remote unauthenticated attacker may potentially exploit this vulnerability and cause a Denial of Service (Storage Processor Panic) by sending an out of order SSH protocol sequence. Additional Analyst Notes: - CVE Program Conta
Storage Processor Panic) by sending an out of order SSH protocol sequence. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/540336/DSA-2020-019-Dell-EMC-Unity-Family-Dell-EMC-Unity-XT-Family-Denial-of-Service-Vulnerability
CVE ID: CVE-2020-5320 State: PUBLISHED Published: 2021-07-19T21:30:32.974439Z Last Updated: 2024-09-16T16:38:34.267Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H) Vendors: Dell Products: Dell OpenManage Enterprise Problem Types: CWE-89 Description: Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQL injection vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbd
unauthorized actions. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000176929/dsa-2020-023-dell-emc-openmanage-enterprise-enterprise-modular-multiple-vulnerabilities
CVE ID: CVE-2020-5321 State: PUBLISHED Published: 2021-07-19T21:30:35.002071Z Last Updated: 2024-09-17T03:54:22.407Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H) Vendors: Dell Products: Dell OpenManage Enterprise Problem Types: CWE-20 Description: Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an improper input validation vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to spawn tasks with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en
vated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000176929/dsa-2020-023-dell-emc-openmanage-enterprise-enterprise-modular-multiple-vulnerabilities
CVE ID: CVE-2020-5322 State: PUBLISHED Published: 2021-07-19T21:30:36.504805Z Last Updated: 2024-09-16T17:59:45.710Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Dell Products: Dell OpenManage Enterprise Modular Problem Types: CWE-78 Description: Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A remote authenticated malicious user with high privileges could potentially exploit the vulnerability to execute arbitrary shell commands on the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000176929/dsa-2020-023-dell-e
yst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000176929/dsa-2020-023-dell-emc-openmanage-enterprise-enterprise-modular-multiple-vulnerabilities
CVE ID: CVE-2020-5323 State: PUBLISHED Published: 2021-07-19T21:30:39.113493Z Last Updated: 2024-09-16T18:59:31.449Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) Vendors: Dell Products: Dell OpenManage Enterprise Problem Types: CWE-611 Description: Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an injection vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability to gain access to sensitive information or cause denial-of-service. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/sup
on or cause denial-of-service. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/kbdoc/en-us/000176929/dsa-2020-023-dell-emc-openmanage-enterprise-enterprise-modular-multiple-vulnerabilities
CVE ID: CVE-2020-5324 State: PUBLISHED Published: 2020-02-21T14:50:13.781202Z Last Updated: 2024-09-17T02:16:34.647Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: Dell Client Consumer and Commercial Platforms Problem Types: CWE-427 Description: Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a
eged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN320348
CVE ID: CVE-2020-5326 State: PUBLISHED Published: 2020-02-21T14:50:14.182576Z Last Updated: 2024-09-17T01:56:45.382Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H) Vendors: Dell Products: Dell Client Consumer and Commercial Platforms Problem Types: CWE-306 Description: Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot Intel Rapid Storage Response Technology (iRST) Manager menu. An attacker with physical access to the system could perform unauthorized changes to the BIOS Setup configuration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot i
guration settings without requiring the BIOS Admin password by selecting the Optimized Defaults option in the pre-boot iRST Manager. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN320337
CVE ID: CVE-2020-5327 State: PUBLISHED Published: 2020-03-06T20:25:13.824208Z Last Updated: 2024-09-16T20:47:30.272Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Encryption Enterprise Problem Types: CWE-502 Description: Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the internet and Windows Firewall is disabled, a remote unauthenticated attacker may exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host. Additional Analyst Notes: - CVE Program Container: References: - https://www.d
xecute arbitrary code on the target host. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN320536
CVE ID: CVE-2020-5328 State: PUBLISHED Published: 2020-03-06T20:25:14.219804Z Last Updated: 2024-09-16T18:29:46.134Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Isilon OneFS Problem Types: CWE-306 Description: Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/541423/DSA-2020-039-Dell-EMC-Isilon-OneFS-Secu
tainer: References: - https://www.dell.com/support/security/en-us/details/541423/DSA-2020-039-Dell-EMC-Isilon-OneFS-Security-Update-for-a-SyncIQ-Vulnerability