CVE-2022-34384: Execution with Unnecessary Privileges

Dell SupportAssist Client Consumer version 3.11.1 and prior, SupportAssist Client Commercial version 3.2 and prior, Dell Command | Update, Dell Update, and Alienware Update versions before 4.5 contain a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local...

PT-2023-13370

Name of the Vulnerable Software and Affected Versions Dell SupportAssist Client Consumer versions 3.11.1 and prior Dell SupportAssist Client Commercial versions 3.2 and prior Dell Command | Update versions prior to 4.5 Dell Update versions prior to 4.5 Alienware Update versions prior to 4.5...

CVE-2022-22566: DMA Device Enabled Too Early in Boot Phase

Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access DMA vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device...

CVE-2022-22567: Insufficient Verification of Data Authenticity

Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An authenticated malicious user may exploit this vulnerability in order to install modified BIOS firmware...

CVE-2021-36286

Dell SupportAssist Client Consumer versions 3.9.13.0 and earlier are affected by an arbitrary file deletion vulnerability tied to NTFS symbolic links and junction points. The clean-files function treats junction points as normal folders, allowing non-privileged users to cause deletion of files ac...

CVE-2020-5361: Weak Password Recovery Mechanism for Forgotten Password

Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords. Dell is aware of unauthorized password generation tools that can generate BIOS recovery passwords. The tools, which are not...

PT-2021-12399

Name of the Vulnerable Software and Affected Versions Dell Client Commercial and Consumer platforms affected versions not specified Description The issue concerns unauthorized password generation tools that can reset BIOS passwords and BIOS-managed Hard Disk Drive HDD passwords. An unauthenticate...

CVE-2020-5363: Improper Neutralization of Null Byte or NUL Character

Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS...

CVE-2020-5362: Improper Authorization

Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized actor, with local system access with OS administrator privileges, could bypass the BIOS Administrator authentication to restore BIOS Setup...

PT-2020-18428

Name of the Vulnerable Software and Affected Versions Dell Client Consumer and Commercial platforms affected versions not specified Description The issue allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This...

PT-2020-18427

Name of the Vulnerable Software and Affected Versions Dell Client Consumer and Commercial platforms affected versions not specified Description The issue concerns an improper authorization vulnerability in the Dell Manageability interface. An unauthorized actor with local system access and OS...

CVE-2020-5357

CVE-2020-5357 :Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The flaw is exploitable during the administrator execution window via a symlink attack by a locally authenticated, low-privileged user, en...

CVE-2020-5324: Uncontrolled Search Path Element

Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utility during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged...

PT-2020-18401

Name of the Vulnerable Software and Affected Versions Dell Client Consumer and Commercial Platforms affected versions not specified Description The issue allows a locally authenticated low-privileged malicious user to exploit the Dell Firmware Update Utility by tricking an administrator into...

CVE-2019-3717: Undefined Security Weakness

Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical access to the system could potentially bypass intended Secure Boot restrictions to run unsigned and untrusted code on expansion cards installed in the system...

CVE-2016-3112

client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and...

CVE-2016-3112: Improper Access Control

client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as world-readable, which allows remote authenticated users to obtain the consumer private keys and escalate privileges by reading /etc/pki/pulp/consumer/consumer-cert, and...