CVE-2019-18576

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users with access to the log files may use the exposed passwords to gain access to XtremIO with the privileges of the compromised user...

CVE-2019-18576

Dell EMC XtremIO XMS vulnerable prior to version 6.3.0 due to an information disclosure where OS users’ passwords are logged in local log files. Local attackers with access to logs can reuse exposed passwords to access XtremIO with the compromised user’s privileges. Remediation: upgrade to 6.3.0+...

CVE-2019-18576: Insertion of Sensitive Information into Log File

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users with access to the log files may use the exposed passwords to gain access to XtremIO with the privileges of the compromised user...

PT-2020-9964

Name of the Vulnerable Software and Affected Versions: Dell EMC XtremIO XMS versions prior to 6.3.0 Description: The issue allows malicious local users with access to log files to potentially gain access to XtremIO with the privileges of a compromised user, as OS users' passwords are logged in...

CVE-2019-18578: Improper Neutralization of Input During Web Page Generation

Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malicious remote user of XtremIO may exploit this vulnerability to store malicious HTML or JavaScript code in application fields. When victim users access the injected page through...

PT-2020-9965

Name of the Vulnerable Software and Affected Versions: Dell EMC XtremIO XMS versions prior to 6.3.0 Description: The issue is related to an incorrect permission assignment. A malicious local user with XtremIO xinstall privileges may exploit this to gain root access. Recommendations: For versions...

CVE-2019-18577: Incorrect Permission Assignment for Critical Resource

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local user with XtremIO xinstall privileges may exploit this vulnerability to gain root access...

PT-2020-9966

Name of the Vulnerable Software and Affected Versions: Dell EMC XtremIO XMS versions prior to 6.3.0 Description: The issue allows a low-privileged malicious remote user to store malicious HTML or JavaScript code in application fields. When victim users access the injected page through their...

CVE-2020-5328

Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur...

Authorization

Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur...

CVE-2020-5328

Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur...

CVE-2020-5328

Dell EMC Isilon OneFS before version 8.2.0 contains an unauthorized access vulnerability due to insufficient authorization checks when SyncIQ is licensed; encrypted syncs are not marked as required, potentially allowing loss of cluster control. The issue affects the Isilon OneFS platform (SyncIQ-...

PT-2020-18404

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions prior to 8.2.0 Description The issue is related to unauthorized access due to insufficient authorization checks when SyncIQ is licensed but encrypted syncs are not marked as required, potentially leading to loss ...

CVE-2020-5328: Missing Authentication for Critical Function

Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur...

Dell EMC Avamar Server Input Validation Error Vulnerability

Dell EMC Avamar Server is a suite of fully virtualized backup and recovery software for servers from Dell USA. An input validation error vulnerability exists in Dell EMC Avamar Server versions 7.3.1 and 7.4.1. The vulnerability originates from a network system or product that does not properly...

CVE-2020-5341

Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 and 2.4.1 contain a Deserialization of Untrusted Data Vulnerability. A remote unauthenticated...

CVE-2020-5329

Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links...

CVE-2020-5328

Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur...

Dell EMC ECS Cross-Site Scripting Vulnerability

DELL EMC ELASTIC CLOUD STORAGE ECS software-defined object storage, designed for legacy and next-generation workloads, offers excellent scalability, flexibility and resiliency. Dell EMC ECS cross-site scripting vulnerability. The vulnerability stems from a lack of proper validation of client data...

CVE-2020-5319

Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Server SSH implementation that is used to provide SFTP service on a NAS server. A remote unauthenticated attacker may potentially exploit this vulnerability an...