CVE-2020-26180: Incorrect Default Permissions

Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with the remotesupport user account. A remote malicious user with low privileges may gain access to data stored on the /ifs directory through most protocols...

PT-2021-11216

Name of the Vulnerable Software and Affected Versions: Dell EMC Isilon OneFS versions 8.1 and later Dell EMC PowerScale OneFS version 9.0.0 Description: The issue concerns an access problem with the remotesupport user account, allowing a remote malicious user with low privileges to gain access to...

PT-2021-11217

Name of the Vulnerable Software and Affected Versions: Dell EMC Isilon OneFS versions 8.1 and later Dell EMC PowerScale OneFS version 9.0.0 Description: The issue concerns a privilege escalation vulnerability on a SmartLock Compliance mode cluster. A compadmin user connecting using ISI PRIV LOGIN...

CVE-2020-26181: Improper Privilege Management

Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance mode cluster. The compadmin user connecting using ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE can elevate privileges to the root user if...

PT-2020-18434

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions 8.2.2 and earlier Dell EMC PowerScale OneFS version 9.0.0 Description The issue allows an authenticated malicious user to exploit a privilege escalation vulnerability, potentially gaining unauthorized access to...

CVE-2020-5369: Incorrect Permission Assignment for Critical Resource

Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability. An authenticated malicious user may exploit this vulnerability by using SyncIQ to gain unauthorized access to system management files...

PT-2020-18443

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS version 8.2.2 Dell EMC PowerScale OneFS version 9.0.0 Description The issue is related to a buffer overflow in the Likewise component. A remote unauthenticated attacker may potentially exploit this to cause a process...

CVE-2020-5383: Improper Restriction of Operations within the Bounds of a Memory Buffer

Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerability in the Likewise component. A remote unauthenticated malicious attacker may potentially exploit this vulnerability to cause a process restart...

CVE-2020-5371: Incorrect Permission Assignment for Critical Resource

Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale version 9.0.0 contain a file permissions vulnerability. An attacker, with network or local file access, could take advantage of insufficiently applied file permissions or gain unauthorized access to files...

PT-2020-18435

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions 8.2.2 and earlier Dell EMC PowerScale version 9.0.0 Description The issue concerns a file permissions vulnerability. An attacker with network or local file access could exploit insufficiently applied file...

CVE-2020-5364: Insertion of Sensitive Information Into Sent Data

Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by default, with a pre-configured community string. This community string allows read-only access to many aspects of the Isilon cluster, some of which are considered sensitive and can...

PT-2020-18429

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions 8.2.2 and earlier Description The issue concerns an SNMPv2 vulnerability where the SNMPv2 service is enabled by default with a pre-configured community string, allowing read-only access to various aspects of the...

CVE-2020-5365: Predictable from Observable State

Dell EMC Isilon versions 8.2.2 and earlier contain a remotesupport vulnerability. The pre-configured support account, remotesupport, is bundled in the Dell EMC Isilon OneFS installation. This account is used for diagnostics and other support functions. Although the default password is different f...

CVE-2020-5347: Uncontrolled Resource Consumption

Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses...

PT-2020-18419

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions 8.2.2 and earlier Description The issue is related to a denial of service condition in SmartConnect. An error condition may cause it to loop, consuming CPU resources and potentially preventing other SmartConnect...

CVE-2020-5328: Missing Authentication for Critical Function

Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur...

PT-2020-18404

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions prior to 8.2.0 Description The issue is related to unauthorized access due to insufficient authorization checks when SyncIQ is licensed but encrypted syncs are not marked as required, potentially leading to loss ...

CVE-2020-5318

Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability to gain access to restricted files. The non-RAN HTTP and WebDAV file-serving components have a vulnerability wherein when either are...

PT-2020-18399

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions 8.0.0.7, 8.1.0.3, 8.1.0.4, and 8.1.2 Description The issue allows an attacker to gain access to restricted files in certain configurations. This is due to a vulnerability in the non-RAN HTTP and WebDAV file-servi...

CVE-2020-5318: Improper Authorization

Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability to gain access to restricted files. The non-RAN HTTP and WebDAV file-serving components have a vulnerability wherein when either are...