CVE-2021-36279

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with ISIPRIVLOGINSSH or ISIPRIVLOGINCONSOLE to access privileged information about the cluster...

CVE-2021-36278

CVE-2021-36278 affects Dell EMC PowerScale OneFS (versions 8.2.x, 9.1.0.x, 9.1.1.1). The issue is a sensitive information exposure in log files, exploitable by a local attacker who holds ISI_PRIV_LOGIN_SSH, ISI_PRIV_LOGIN_CONSOLE, or ISI_PRIV_SYS_SUPPORT. If third-party systems consume these logs...

CVE-2021-36278

Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files. A local malicious user with ISIPRIVLOGINSSH, ISIPRIVLOGINCONSOLE, or ISIPRIVSYSSUPPORT privileges may exploit this vulnerability to access sensitive information. If...

CVE-2021-21599

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability. This may allow a user with ISIPRIVLOGINSSH or ISIPRIVLOGINCONSOLE to escalate privileges and escape the compliance guarantees. This only impacts Smartlock WORM compliance mode clusters as a critical...

CVE-2021-21599

Dell EMC PowerScale OneFS versions 8.2.x–9.2.1.x are affected by an OS command injection vulnerability that can enable privilege escalation for a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE, potentially evading Smartlock WORM compliance. Affected component is the OneFS OS; root cause d...

CVE-2021-21595

Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. This vulnerability could allow the compadmin user to elevate privileges. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell...

CVE-2021-21595

Dell EMC PowerScale OneFS (versions 8.2.x–9.1.1.x) contains an elevation-of-privileges flaw caused by improper neutralization of special elements in an OS command. The vulnerability could allow the compadmin user to gain higher privileges, and is reported to impact Smartlock WORM compliance mode ...

CVE-2021-21594

Dell PowerScale OneFS (versions 8.2.2–9.1.0.x) exposes sensitive data due to use of the GET request method with a sensitive query string. The root cause is information disclosure from that query handling, as described across multiple sources (CNVD/CNNVD and NVD entries). Impact is potential expos...

CVE-2021-21594

Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. It can lead to potential disclosure of sensitive data. Dell recommends upgrading at your earliest opportunity...

CVE-2021-21592

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x improperly handle an exceptional condition. A remote low privileged user could potentially exploit this vulnerability, leading to unauthorized information disclosure...

CVE-2021-21592

Dell EMC PowerScale OneFS versions 8.2.x–9.2.x contain an information disclosure vulnerability due to improper handling of an exceptional condition. A remote low-privilege attacker could exploit this to obtain information that should be restricted. The core issue is the improper exception handlin...

CVE-2021-21568

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an insufficient logging vulnerability. An authenticated user with ISIPRIVLOGINPAPI could make un-audited and un-trackable configuration changes to settings that their roles have privileges to change...

CVE-2021-21568

Dell EMC PowerScale OneFS (versions 8.2.x–9.2.x) has an insufficient logging vulnerability that lets an authenticated user with ISI_PRIV_LOGIN_PAPI make unaudited, un‑trackable configuration changes to settings their role permits. The impact is unlogged changes to settings with low to moderate se...

Dell Technologies Dell PowerScale OneFS 安全漏洞

Dell EMC PowerScale OneFS, an API-driven file system, is vulnerable to an information disclosure in Dell EMC PowerScale OneFS version 8.2.2-9.1.0.. The vulnerability stems from the product's use of a get request method with a sensitive query string. An attacker could exploit the vulnerability to...

DELL EMC PowerScale 命令注入漏洞

Dell EMC PowerScale OneFS is an API-driven file system. security vulnerability exists in Dell EMC PowerScale OneFS version 8.2.-9.1.1.. An attacker could exploit the vulnerability to elevate privileges...

DELL EMC PowerScale 安全漏洞

Dell EMC PowerScale OneFS is an API-driven file system. version 8.2.-9.2. of Dell EMC PowerScale OneFS is vulnerable to insufficient logging. An attacker could exploit this vulnerability to make unaudited and untraceable configuration changes to settings that their role is authorized to change...

CVE-2021-21594: Use of GET Request Method With Sensitive Query Strings

Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. It can lead to potential disclosure of sensitive data. Dell recommends upgrading at your earliest opportunity...

CVE-2021-36279: Incorrect Permission Assignment for Critical Resource

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with ISIPRIVLOGINSSH or ISIPRIVLOGINCONSOLE to access privileged information about the cluster...

CVE-2021-36282: Use of Uninitialized Resource

Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. This can potentially allow an authenticated user with ISIPRIVLOGINCONSOLE or ISIPRIVLOGINSSH privileges to gain access up to 24 bytes of data within the /ifs kernel stack under certain...

CVE-2021-36280: Incorrect Permission Assignment for Critical Resource

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. This could allow a user with ISIPRIVLOGINSSH or ISIPRIVLOGINCONSOLE to access privileged information about the cluster...