Dell EMC ScaleIO Denial of Service Vulnerability

Dell EMC ScaleIO is a software-defined solution for converting DAS storage into shared data block storage from Dell, Inc. A security vulnerability exists in Dell EMC ScaleIO versions prior to 2.5, which stems from the program failing to properly handle packet data. A remote attacker could exploit...

Command injection

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...

CVE-2018-1237

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent LIA. This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having...

CVE-2018-1238

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...

Code injection

Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash...

Input validation

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent LIA. This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having...

CVE-2018-1237

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent LIA. This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having...

CVE-2018-1205

Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash...

CVE-2018-1205

Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash...

CVE-2018-1205

Dell EMC ScaleIO (pre-2.5) is affected by CVE-2018-1205 due to improper handling of packet data in the MDM service. A remote attacker could exploit crafted packets to crash the MDM service. The CVE is documented with a CVSS v3 base score of 7.5 (HIGH) and CVSS v2 base score of 5.0 (MEDIUM). Publi...

CVE-2018-1237

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent LIA. This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having...

CVE-2018-1205

Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash...

CVE-2018-1238

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...

CVE-2018-1237

CVE-2018-1237 affects Dell EMC ScaleIO versions prior to 2.5. The vulnerability resides in the Light Installation Agent (LIA) and stems from improper restriction of excessive authentication attempts. A remote attacker with network access to LIA could brute-force usernames and passwords on LIA-man...

CVE-2018-1238

Dell EMC ScaleIO prior to version 2.5 is affected by CVE-2018-1238 due to a command-injection flaw in the Light Installation Agent (LIA), which handles deployment management and uses shell commands. A remote attacker with network access to LIA and knowledge of the LIA administrative password coul...

Dell EMC iDRAC7 and iDRAC8 Code Execution Vulnerabilities

Dell EMC iDRAC7 and iDRAC8 are both hardware and software-inclusive system management solutions from Dell USA. The solutions provide remote management, crash system recovery and power control for Dell PowerEdge systems. A security vulnerability exists in Dell EMC iDRAC7 and iDRAC8. A remote...

Dell EMC Isilon OneFS Cross-Site Request Forgery Vulnerability

DELL EMC Isilon is a horizontally scalable storage system for unstructured data from Dell.OneFS is the operating system that runs on it. A cross-site request forgery vulnerability exists in Dell EMC Isilon OneFS. A remote attacker could exploit this vulnerability to perform unauthorized operation...

Dell EMC Isilon OneFS Incorrect Authorization Vulnerability

DELL EMC Isilon is a horizontally scalable storage system for unstructured data from Dell.OneFS is the operating system that runs on it. A security vulnerability exists in Dell EMC Isilon OneFS. An attacker could exploit this vulnerability to execute arbitrary code with root privileges...

Dell EMC Isilon Cross-Site Scripting Vulnerability (CNVD-2018-07580)

DELL EMC Isilon is a horizontally scalable storage system for unstructured data from Dell.OneFS web administration interface is one of the web administration interfaces. A security vulnerability exists in the NDMP page of the OneFS web administration interface in Dell EMC Isilon. An attacker coul...

Dell EMC Isilon Cross-Site Scripting Vulnerability (CNVD-2018-07641)

DELL EMC Isilon is a horizontally scalable storage system for unstructured data from Dell.OneFS web administration interface is one of the web administration interfaces. A cross-site scripting vulnerability exists in the Authorization Providers page of the OneFS web administration interface in De...