Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-5329 State: PUBLISHED Published: 2021-07-29T15:55:14.184551Z Last Updated: 2024-09-16T22:40:39.262Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Dell Products: Avamar Problem Types: CWE-601 Description: Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/541529/DSA-2020-046-Dell-EMC-Avamar-Server-Open-Redirect-Vulnerability
CVE ID: CVE-2020-5330 State: PUBLISHED Published: 2020-04-10T18:55:11.617623Z Last Updated: 2024-09-16T20:16:29.129Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell PowerConnect Problem Types: CWE-200 Description: Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22 and older and Dell EMC PowerEdge VRTX Switch Modules firmware versions 2.0.0.77 and older contain an information disclosure vulnerability. A remote unauthenticated attacker could exploit this vulnerability to retrieve sensitive data by sending a specially crafted request to the affected endpoints. Additional Anal
lnerability to retrieve sensitive data by sending a specially crafted request to the affected endpoints. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/en-us/sln320366/dsa-2020-042-dell-emc-networking-security-update-for-an-information-disclosure-vulnerability?lang=en - http://packetstormsecurity.com/files/171723/Cisco-Dell-Netgear-Information-Disclosure-Hash-Decrypter.html
CVE ID: CVE-2020-5331 State: PUBLISHED Published: 2020-05-04T18:50:19.125428Z Last Updated: 2024-09-17T02:06:43.093Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: RSA Archer Problem Types: CWE-598 Description: RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability. Users’ session information could potentially be stored in cache or log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020
st Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities
CVE ID: CVE-2020-5332 State: PUBLISHED Published: 2020-05-04T18:50:19.554043Z Last Updated: 2024-09-16T22:41:16.968Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: RSA Archer Problem Types: CWE-78 Description: RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain a command injection vulnerability. AN authenticated malicious user with administrator privileges could potentially exploit this vulnerability to execute arbitrary commands on the system where the vulnerable application is deployed. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Se
ogram Container: References: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities
CVE ID: CVE-2020-5333 State: PUBLISHED Published: 2020-05-04T18:50:19.977502Z Last Updated: 2024-09-16T16:43:48.571Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: RSA Archer Problem Types: CWE-285 Description: RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user could potentially exploit this vulnerability to view unauthorized information. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities
CVE ID: CVE-2020-5334 State: PUBLISHED Published: 2020-05-04T18:50:20.505600Z Last Updated: 2024-09-16T18:59:21.546Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: Dell Products: RSA Archer Problem Types: CWE-79 Description: RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contains a Document Object Model (DOM) based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application. Additional A
r. The malicious code is then executed by the web browser in the context of the vulnerable web application. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities
CVE ID: CVE-2020-5335 State: PUBLISHED Published: 2020-05-04T18:50:21.028601Z Last Updated: 2024-09-16T22:02:14.994Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N) Vendors: Dell Products: RSA Archer Problem Types: CWE-352 Description: RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to send arbitrary requests to the vulnerable application to perform server operations with the privileges of the authenticated victim user. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.co
s of the authenticated victim user. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities
CVE ID: CVE-2020-5336 State: PUBLISHED Published: 2020-05-04T18:50:21.452332Z Last Updated: 2024-09-17T03:14:04.607Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Dell Products: RSA Archer Problem Types: CWE-79 Description: RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-
: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities
CVE ID: CVE-2020-5337 State: PUBLISHED Published: 2020-05-04T18:50:21.929035Z Last Updated: 2024-09-17T01:56:11.650Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Dell Products: RSA Archer Problem Types: CWE-601 Description: RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites. Additional Analyst Notes: - CVE Prog
to conduct phishing attacks that cause users to unknowingly visit malicious sites. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/DOC-111112/DSA-2020-049-RSA-Archer-Security-Update-for-Multiple-Vulnerabilities
CVE ID: CVE-2020-5339 State: PUBLISHED Published: 2020-03-25T21:05:14.708471Z Last Updated: 2024-09-17T00:06:00.697Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Dell Products: RSA Authentication Manager Problem Types: CWE-79 Description: RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators open the affected report page, the i
ough the Security Console web interface. When other Security Console administrators open the affected report page, the injected scripts could potentially be executed in their browser. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-111092
CVE ID: CVE-2020-5340 State: PUBLISHED Published: 2020-03-25T21:05:15.109747Z Last Updated: 2024-09-17T03:43:40.798Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Dell Products: RSA Authentication Manager Problem Types: CWE-79 Description: RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators attempt to change the default securi
ough the Security Console web interface. When other Security Console administrators attempt to change the default security domain mapping, the injected scripts could potentially be executed in their browser. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-111092
CVE ID: CVE-2020-5341 State: PUBLISHED Published: 2021-07-28T00:05:14.643317Z Last Updated: 2024-09-16T22:34:55.121Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Avamar Virtual Edition Problem Types: CWE-502 Description: Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 and 2.4.1 contain a Deserialization of Untrusted Data Vulnerability. A remote unauthenticated attacker could exploit this vulnerability to send a serialized payload that would execute code on the system. Additional Analys
r could exploit this vulnerability to send a serialized payload that would execute code on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/541677/DSA-2020-057-Dell-EMC-Avamar-Server-Deserialization-of-Untrusted-Data-Vulnerability
CVE ID: CVE-2020-5342 State: PUBLISHED Published: 2020-03-09T19:45:13.366401Z Last Updated: 2024-09-16T21:56:57.960Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Digital Delivery (Cirrus) Problem Types: CWE-276 Description: Dell Digital Delivery versions prior to 3.5.2015 contain an incorrect default permissions vulnerability. A locally authenticated low-privileged malicious user could exploit this vulnerability to run an arbitrary executable with administrative privileges on the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN320561
CVE ID: CVE-2020-5343 State: PUBLISHED Published: 2020-05-04T18:50:22.459773Z Last Updated: 2024-09-17T00:10:31.625Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: CPG SW Problem Types: CWE-277 Description: Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permissions vulnerability. A local authenticated malicious user with low privileges could exploit this vulnerability to gain unauthorized access on the root folder. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN321036
CVE ID: CVE-2020-5344 State: PUBLISHED Published: 2020-03-31T21:30:13.281285Z Last Updated: 2024-09-17T02:02:37.472Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: Dell Products: Integrated Dell Remote Access Controller (iDRAC) Problem Types: CWE-121 Description: Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/s
ng specially crafted input data. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/en-us/sln320717/dsa-2020-063-idrac-buffer-overflow-vulnerability?lang=en
CVE ID: CVE-2020-5345 State: PUBLISHED Published: 2020-06-23T20:00:17.264990Z Last Updated: 2024-09-17T01:51:14.465Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L) Vendors: Dell Products: Unisphere for PowerMax Problem Types: CWE-602 Description: Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Release 5978 contain an authorization bypass vulnerability. An authenticated malicious user may potentially execute commands to alter or stop database statistics. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/d
atistics. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/544585/DSA-2020-065-Dell-EMC-Unisphere-for-PowerMax-Dell-EMC-Unisphere-for-PowerMax-Virtual-Appliance
CVE ID: CVE-2020-5346 State: PUBLISHED Published: 2020-04-15T18:00:18.313886Z Last Updated: 2024-09-16T19:56:48.979Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Dell Products: RSA Authentication Manager Problem Types: CWE-79 Description: RSA Authentication Manager versions prior to 8.4 P11 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators open the affected page, the injected
ough the Security Console web interface. When other Security Console administrators open the affected page, the injected scripts could potentially be executed in their browser. Additional Analyst Notes: - CVE Program Container: References: - https://community.rsa.com/docs/DOC-111347
CVE ID: CVE-2020-5347 State: PUBLISHED Published: 2020-04-03T23:20:14.052775Z Last Updated: 2024-09-16T18:28:55.455Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Dell Products: Isilon OneFS Problem Types: CWE-400 Description: Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/542190/DSA-2020-054-Dell-EMC-Isilon-OneFS-Security-Update-for-DNS-Protocol-Vulnerabilities
CVE ID: CVE-2020-5348 State: PUBLISHED Published: 2020-04-03T23:20:14.488798Z Last Updated: 2024-09-17T03:02:11.254Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-416 Description: Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI_BOOT_SERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFI_BOOT_SERVICES structure to execute arbitrary code in system management mode. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN320792
CVE ID: CVE-2020-5349 State: PUBLISHED Published: 2021-07-19T21:30:40.661908Z Last Updated: 2024-09-17T01:56:58.326Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Networking Problem Types: CWE-798 Description: Dell EMC Networking S4100 and S5200 Series Switches manufactured prior to February 2020 contain a hardcoded credential vulnerability. A remote unauthenticated malicious user could exploit this vulnerability and gain administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/en-us/sln320599/dsa-2020-074-dell-networking-security-update-for-a-hardcoded-credential-vuln
ww.dell.com/support/article/en-us/sln320599/dsa-2020-074-dell-networking-security-update-for-a-hardcoded-credential-vulnerability?lang=en
CVE ID: CVE-2020-5350 State: PUBLISHED Published: 2020-04-15T18:00:18.727517Z Last Updated: 2024-09-16T17:54:54.783Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H) Vendors: Dell Products: Integrated Data Protection Appliance Problem Types: CWE-78 Description: Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords and execution of malicious commands on ACM component. Additional Analyst Notes: - CVE Program Container: References: -
and execution of malicious commands on ACM component. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability
CVE ID: CVE-2020-5351 State: PUBLISHED Published: 2021-07-28T00:05:16.265310Z Last Updated: 2024-09-17T01:31:23.532Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell Products: Data Protection Advisor Problem Types: CWE-259 Description: Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with the knowledge of the hard-coded password may login to the system and gain read-only privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/542649/D
ional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/542649/DSA-2020-080-Dell-EMC-Data-Protection-Advisor-Hard-Coded-Credential-Vulnerability
CVE ID: CVE-2020-5352 State: PUBLISHED Published: 2020-07-06T17:45:17.498676Z Last Updated: 2024-09-16T23:00:35.057Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Data Protection Advisor Problem Types: CWE-78 Description: Dell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may exploit this vulnerability to execute arbitrary commands on the affected system. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/542719/DSA-2020-081-Dell-EMC-Data-Protection-Advisor-OS-Command-Injection-Vulnerability
CVE ID: CVE-2020-5353 State: PUBLISHED Published: 2021-07-29T15:55:15.791310Z Last Updated: 2024-09-17T00:27:01.594Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell Products: Isilon OneFS Problem Types: CWE-276 Description: The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifier (UID) over NFS to rewrite sensitive files to gain administrative access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.emc.com/kb/542721
CVE ID: CVE-2020-5355 State: PUBLISHED Published: 2022-10-21T18:05:24.132Z Last Updated: 2025-05-07T15:55:32.107Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Dell Products: Isilon OneFS Problem Types: CWE-276 Description: The Dell Isilon OneFS versions 8.2.2 and earlier SSHD process improperly allows Transmission Control Protocol (TCP) and stream forwarding. This provides the remotesupport user and users with restricted shells more access than is intended. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.emc.com/kb/543561
CVE ID: CVE-2020-5356 State: PUBLISHED Published: 2020-07-06T17:45:17.910815Z Last Updated: 2024-09-16T19:36:53.503Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Dell Products: Power Protect Data Manager Problem Types: CWE-285 Description: Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. A remote authenticated malicious user may download any file from the affected PowerProtect virtual machines. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/security/en-us/details/544733/DSA-2020-099-Dell-PowerProtect-Da
am Container: References: - https://www.dell.com/support/security/en-us/details/544733/DSA-2020-099-Dell-PowerProtect-Data-Manager-Improper-Authorization-Vulnerability
CVE ID: CVE-2020-5357 State: PUBLISHED Published: 2020-05-28T19:20:12.112405Z Last Updated: 2024-09-16T22:09:55.405Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Dell Products: CPG BIOS Problem Types: CWE-427 Description: Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbi
icated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN321564
CVE ID: CVE-2020-5358 State: PUBLISHED Published: 2020-06-15T20:20:11.377037Z Last Updated: 2024-09-17T01:56:50.455Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Dell Products: Dell Encryption Enterprise Problem Types: CWE-732 Description: Dell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability due to incorrect permissions. A local malicious user with low privileges could potentially exploit this vulnerability to gain elevated privilege on the affected system with the help of a symbolic link. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.
tem with the help of a symbolic link. Additional Analyst Notes: - CVE Program Container: References: - https://www.dell.com/support/article/SLN321789