CVE-2019-18582

Dell EMC Data Protection Advisor (DPA) REST API versions 6.3/6.4/6.5, 18.2 before patch 83, and 19.1 before patch 71 are affected by a server-side template injection vulnerability. A remote authenticated attacker with admin privileges can inject scripts via the report generation feature, potentia...

CVE-2019-18581

Dell EMC Data Protection Advisor (DPA) versions 6.3, 6.4, 6.5, 18.2 before patch 83, and 19.1 before patch 71 are affected by a server missing authorization in the REST API. A remote authenticated administrator could potentially modify the application’s allowed OS commands list, enabling arbitrar...

CVE-2019-18582: Improper Control of Generation of Code

Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...

CVE-2019-18581: Missing Authorization

Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authorization vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...

PT-2020-9967

Name of the Vulnerable Software and Affected Versions: Dell EMC Data Protection Advisor versions 6.3 through 6.5 Dell EMC Data Protection Advisor version 18.2 prior to patch 83 Dell EMC Data Protection Advisor version 19.1 prior to patch 71 Description: The issue concerns a server missing...

PT-2020-9968

Name of the Vulnerable Software and Affected Versions: Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5 Dell EMC Data Protection Advisor versions 18.2 prior to patch 83 Dell EMC Data Protection Advisor versions 19.1 prior to patch 71 Description: The issue concerns a server-side template...

Dell EMC XtremIO XMS Cross-Site Scripting Vulnerability

Dell EMC XtremIO XMS is a suite of XtremIO Enterprise Storage Platform management software from Dell USA. A cross-site scripting vulnerability exists in Dell EMC XtremIO XMS versions prior to 6.3.0. The vulnerability stems from a lack of proper validation of client data by the WEB application. An...

Dell EMC XtremIO XMS Information Disclosure Vulnerability

Dell EMC XtremIO XMS is a suite of XtremIO Enterprise Storage Platform management software from Dell USA. An information disclosure vulnerability exists in Dell EMC XtremIO XMS versions prior to 6.3.0. The vulnerability stems from an error in the configuration, etc. of a networked system or produ...

Dell EMC XtremIO XMS Privilege Assignment Vulnerability

Dell EMC XtremIO XMS is a suite of XtremIO Enterprise Storage Platform management software from Dell USA. A security vulnerability exists in Dell EMC XtremIO XMS prior to version 6.3.0, which stems from an incorrect privilege assignment. A local attacker could exploit the vulnerability to gain ro...

CVE-2019-18577

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xinstall privileges may exploit this vulnerability to gain root access...

CVE-2019-18576

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users with access to the log files may use the exposed passwords to gain access to XtremIO with the privileges of the compromised user...

CVE-2019-18578

Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of XtremIO may exploit this vulnerability to store malicious HTML or JavaScript code in application fields. When victim users access the injected page through...

CVE-2019-18577

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xinstall privileges may exploit this vulnerability to gain root access...

Information disclosure

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users with access to the log files may use the exposed passwords to gain access to XtremIO with the privileges of the compromised user...

Design/Logic Flaw

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xinstall privileges may exploit this vulnerability to gain root access...

Cross site scripting

Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of XtremIO may exploit this vulnerability to store malicious HTML or JavaScript code in application fields. When victim users access the injected page through...

CVE-2019-18578

Dell EMC XtremIO XMS is affected in versions prior to 6.3.0 by a stored cross-site scripting vulnerability in the web application layer. A low-privileged remote attacker can inject HTML/JavaScript into application fields, which is executed in the context of the vulnerable web app when victims loa...

CVE-2019-18577

Dell EMC XtremIO XMS is affected by a local privilege escalation vulnerability in versions prior to 6.3.0, caused by incorrect permission assignment. A malicious local user with XtremIO xinstall privileges can gain root access. Remediation: upgrade to XtremIO XMS 6.3.0 or later (per cited securit...

CVE-2019-18578

Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of XtremIO may exploit this vulnerability to store malicious HTML or JavaScript code in application fields. When victim users access the injected page through...

CVE-2019-18577

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xinstall privileges may exploit this vulnerability to gain root access...