CVE-2021-36278

CVE-2021-36278 affects Dell EMC PowerScale OneFS (versions 8.2.x, 9.1.0.x, 9.1.1.1). The issue is a sensitive information exposure in log files, exploitable by a local attacker who holds ISI_PRIV_LOGIN_SSH, ISI_PRIV_LOGIN_CONSOLE, or ISI_PRIV_SYS_SUPPORT. If third-party systems consume these logs...

CVE-2021-21599

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability. This may allow a user with ISIPRIVLOGINSSH or ISIPRIVLOGINCONSOLE to escalate privileges and escape the compliance guarantees. This only impacts Smartlock WORM compliance mode clusters as a critical...

CVE-2021-21599

Dell EMC PowerScale OneFS versions 8.2.x–9.2.1.x are affected by an OS command injection vulnerability that can enable privilege escalation for a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE, potentially evading Smartlock WORM compliance. Affected component is the OneFS OS; root cause d...

CVE-2021-21595

Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. This vulnerability could allow the compadmin user to elevate privileges. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell...

CVE-2021-21595

Dell EMC PowerScale OneFS (versions 8.2.x–9.1.1.x) contains an elevation-of-privileges flaw caused by improper neutralization of special elements in an OS command. The vulnerability could allow the compadmin user to gain higher privileges, and is reported to impact Smartlock WORM compliance mode ...

CVE-2021-21594

Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. It can lead to potential disclosure of sensitive data. Dell recommends upgrading at your earliest opportunity...

CVE-2021-21594

Dell PowerScale OneFS (versions 8.2.2–9.1.0.x) exposes sensitive data due to use of the GET request method with a sensitive query string. The root cause is information disclosure from that query handling, as described across multiple sources (CNVD/CNNVD and NVD entries). Impact is potential expos...

CVE-2021-21592

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x improperly handle an exceptional condition. A remote low privileged user could potentially exploit this vulnerability, leading to unauthorized information disclosure...

CVE-2021-21592

Dell EMC PowerScale OneFS versions 8.2.x–9.2.x contain an information disclosure vulnerability due to improper handling of an exceptional condition. A remote low-privilege attacker could exploit this to obtain information that should be restricted. The core issue is the improper exception handlin...

CVE-2021-21568

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an insufficient logging vulnerability. An authenticated user with ISIPRIVLOGINPAPI could make un-audited and un-trackable configuration changes to settings that their roles have privileges to change...

CVE-2021-21568

Dell EMC PowerScale OneFS (versions 8.2.x–9.2.x) has an insufficient logging vulnerability that lets an authenticated user with ISI_PRIV_LOGIN_PAPI make unaudited, un‑trackable configuration changes to settings their role permits. The impact is unlogged changes to settings with low to moderate se...

PT-2021-21195 · Dell Emc · Dell Emc Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell EMC PowerScale OneFS versions 8.2.x through 9.1.1.1 Description: The issue concerns the exposure of sensitive information in log files. A local malicious user with specific privileges, such as ISI PRIV LOGIN SSH, ISI PRIV LOGIN CONSOLE, ...

CVE-2021-36281: Incorrect Permission Assignment for Critical Resource

Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment vulnerability. A low privileged authenticated user can potentially exploit this vulnerability to escalate privileges...

EMC PowerScale 安全漏洞

Dell EMC PowerScale OneFS is an API-powered file system. A vulnerability exists in Dell EMC PowerScale OneFS versions 8.2. - 9.2. in which critical resource permissions are incorrectly assigned. An attacker could exploit this vulnerability to gain unauthorized access to cluster-related informatio...

PT-2021-14636

Name of the Vulnerable Software and Affected Versions Dell EMC PowerScale OneFS versions 8.2.x through 9.2.x Description The issue is related to improper handling of an exceptional condition, which could be exploited by a remote low privileged user, potentially leading to unauthorized information...

PT-2021-14615

Name of the Vulnerable Software and Affected Versions Dell EMC PowerScale OneFS versions 8.2.x through 9.2.x Description The issue is related to insufficient logging, allowing an authenticated user with ISI PRIV LOGIN PAPI privileges to make configuration changes without being audited or tracked...

PT-2021-14637

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 8.2.2 through 9.1.0.x Description The issue concerns a use of GET request method with sensitive query strings, potentially leading to the disclosure of sensitive data. Recommendations For Dell PowerScale OneFS...

PT-2021-14642

Name of the Vulnerable Software and Affected Versions Dell EMC PowerScale OneFS versions 8.2.x through 9.2.1.x Description The issue is an OS command injection vulnerability that may allow a user with ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE privileges to escalate privileges and escape...

PT-2021-21198

Name of the Vulnerable Software and Affected Versions Dell EMC PowerScale OneFS versions 8.2.x through 9.2.x Description The issue is related to an incorrect permission assignment for a critical resource. This could allow a user with ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE privileges to acce...

PT-2021-21196

Name of the Vulnerable Software and Affected Versions Dell EMC PowerScale OneFS versions 8.2.x through 9.2.x Description The issue is related to an incorrect permission assignment for a critical resource. This could allow a user with ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE privileges to acce...