Dell EMC ScaleIO Denial of Service Vulnerability

Dell EMC ScaleIO is a software-defined solution for converting DAS storage into shared data block storage from Dell, Inc. A security vulnerability exists in Dell EMC ScaleIO versions prior to 2.5, which stems from the program failing to properly handle packet data. A remote attacker could exploit...

Dell EMC ScaleIO Command Injection Vulnerability

Dell EMC ScaleIO is a software-defined solution for converting DAS storage to shared data block storage from Dell, U.S.A. Light Installation Agent LIA is one of the installation agent programs. A command injection vulnerability exists in LIA in Dell EMC ScaleIO versions prior to 2.5. An attacker...

Command injection

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...

CVE-2018-1237

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent LIA. This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having...

CVE-2018-1238

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...

Input validation

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent LIA. This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having...

CVE-2018-1205

Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash...

CVE-2018-1237

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent LIA. This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having...

CVE-2018-1238

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...

Code injection

Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash...

CVE-2018-1205

Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash...

CVE-2018-1205

Dell EMC ScaleIO (pre-2.5) is affected by CVE-2018-1205 due to improper handling of packet data in the MDM service. A remote attacker could exploit crafted packets to crash the MDM service. The CVE is documented with a CVSS v3 base score of 7.5 (HIGH) and CVSS v2 base score of 5.0 (MEDIUM). Publi...

CVE-2018-1237

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent LIA. This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having...

CVE-2018-1238

Dell EMC ScaleIO prior to version 2.5 is affected by CVE-2018-1238 due to a command-injection flaw in the Light Installation Agent (LIA), which handles deployment management and uses shell commands. A remote attacker with network access to LIA and knowledge of the LIA administrative password coul...

CVE-2018-1238

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...

CVE-2018-1205

Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash...

CVE-2018-1237

CVE-2018-1237 affects Dell EMC ScaleIO versions prior to 2.5. The vulnerability resides in the Light Installation Agent (LIA) and stems from improper restriction of excessive authentication attempts. A remote attacker with network access to LIA could brute-force usernames and passwords on LIA-man...

CVE-2018-1237: Improper Authentication

Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent LIA. This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having...

CVE-2018-1205: Improper Restriction of Operations within the Bounds of a Memory Buffer

Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash...

CVE-2018-1238: Improper Neutralization of Special Elements used in an OS Command

Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...