Cross site scripting

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Job Operations Page within the OneFS web administration interface. A malicious administrator may...

CVE-2018-1186

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Cluster description of the OneFS web administration interface. A malicious administrator may potentially...

Cross site request forgery (csrf)

Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 and 8.1.0.2 is affected by a cross-site request forgery vulnerability. A malicious user may potentially exploit this vulnerability to send unauthorized reques...

Path traversal

Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a path traversal vulnerability in the isiphonehome tool. A malicious compadmin may potentially exploit this vulnerability to execute arbitrary...

CVE-2018-1189

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Antivirus Page within the OneFS web administration interface. A malicious administrator may potentially...

CVE-2018-1186

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Cluster description of the OneFS web administration interface. A malicious administrator may potentially...

CVE-2018-1202

CVE-2018-1202 is a cross-site scripting vulnerability in the Dell EMC Isilon OneFS NDMP web page. The weakness arises in the OneFS Web administration interface where NDMP page input can inject HTML/JS into the user’s browser session. Affected are Isilon OneFS versions 8.0.0.0–8.0.0.6, 8.0.1.0–8.0...

CVE-2018-1187

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-site scripting vulnerability in the Network Configuration page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or...

CVE-2018-1188

CVE-2018-1188 is a cross-site scripting vulnerability affecting Dell EMC Isilon OneFS Web UI (Authorization Providers page). Affected are OneFS versions 8.1.0.0–8.1.0.1, 8.0.1.0–8.0.1.2, 8.0.0.0–8.0.0.6, and 7.2.1.x. The issue arises from XSS in the Authorization Providers page, allowing injectio...

CVE-2018-1188

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a cross-site scripting vulnerability in the Authorization Providers page within the OneFS web administration interface. A malicious administrator may potentially injec...

CVE-2018-1213

CVE-2018-1213 refers to cross-site request forgery vulnerabilities in Dell EMC Isilon OneFS. Affected versions include OneFS 8.1.0.0–8.1.0.1, 8.0.1.0–8.0.1.2, 8.0.0.0–8.0.0.6, 7.2.1.x, 7.1.1.11, and 8.1.0.2. The issue arises from the Web console lacking anti-CSRF protections, allowing an authenti...

CVE-2018-1202

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the NDMP Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or...

CVE-2018-1186

Dell EMC Isilon OneFS Web Console (Cluster description) contains cross-site scripting vulnerabilities across multiple versions. Affected: OneFS Web administration interface in Isilon clusters running 7.1.1.11, 7.2.1.x, 8.0.0.0–8.0.0.6, 8.0.1.0–8.0.1.2, 8.1.0.0–8.1.0.1. The root cause is insuffici...

CVE-2018-1201

Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-site scripting vulnerability in the Job Operations Page within the OneFS web administration interface. A malicious administrator may...

CVE-2018-1187

Dell EMC Isilon OneFS (web UI) vulnerabilities: multiple XSS issues in the Network Configuration and related Web Console endpoints (CVE-2018-1187 and related CVEs such as 2018-1186, 1188, 1189, 1201–1204, 1213) allow remote injection of HTML/JS by authenticated users. Industry advisories (Core Se...

CVE-2018-1204

Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a path traversal vulnerability in the isiphonehome tool. A malicious compadmin may potentially exploit this vulnerability to execute arbitrary...

CVE-2018-1213

Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 and 8.1.0.2 is affected by a cross-site request forgery vulnerability. A malicious user may potentially exploit this vulnerability to send unauthorized reques...

CVE-2018-1204

Summary for CVE-2018-1204 (Isilon OneFS) : Dell EMC Isilon OneFS web console vulnerabilities include a path traversal flaw in the isi_phone_home tool that can be triggered when remote support is enabled, potentially allowing a malicious user with compadmin rights to execute arbitrary code with ro...

CVE-2018-1203

In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. In versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, the tcpdump binary, being run with sudo, may potentially be used by compadmin to execute arbitrary code with root privileges...

CVE-2018-1203

Overview: CVE-2018-1203 affects Dell EMC Isilon OneFS. CORE Security CORE-2017-0009 describes multiple vulnerabilities in the OneFS Web console, including a local privilege escalation path where the compadmin can exploit sudo to run tcpdump with root privileges. This enables arbitrary root comman...