PT-2024-22649 · Dell · Dell Scg

Name of the Vulnerable Software and Affected Versions: Dell SCG versions prior to 5.24.00.00 Description: The issue is related to an Improper Access Control vulnerability in the SCG exposed for an internal update REST API. This API is only accessible if enabled by an Admin user from the UI. A...

CVE-2024-28968: Improper Access Control

Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for internal email and collection settings REST APIs if enabled by Admin user from UI. A remote low privileged attacker could potentially exploit this vulnerability, leading to the executio...

CVE-2024-28967: Improper Access Control

Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal maintenance REST API if enabled by Admin user from UI. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain API...

CVE-2024-37131: Permissive Cross-domain Policy with Untrusted Domains

SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy CORP vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious actions on the application in the context of the authenticated use...

CVE-2024-28969: Improper Access Control

Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API if enabled by Admin user from UI. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs...

CVE-2024-29169: Improper Neutralization of Special Elements used in an SQL Command

Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal audit REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing...

CVE-2024-28966: Improper Access Control

Dell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API if enabled by Admin user from UI. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain APIs...

CVE-2024-29168: Improper Neutralization of Special Elements used in an SQL Command

Dell SCG, versions prior to 5.22.00.00, contain a SQL Injection Vulnerability in the SCG UI for an internal assets REST API. A remote authenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database causing...

PT-2024-27323

Name of the Vulnerable Software and Affected Versions SCG Policy Manager, all versions Description The issue is related to an overly permissive Cross-Origin Resource Policy CORP that could be exploited by a remote unauthenticated attacker. This could lead to the execution of malicious actions on...

Cross site scripting

Dell Secure Connect Gateway SCG Policy Manager, all versions, contains a Stored Cross-Site Scripting Vulnerability. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data...

Design/Logic Flaw

Dell Secure Connect Gateway SCG Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the...

CVE-2024-24903

Dell Secure Connect Gateway SCG Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this vulnerability, leading to unauthorized access to the application with privileges of the...

CVE-2024-24903

Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+ is affected by a weak password recovery mechanism. An adjacent-network, low-privilege attacker could exploit this flaw to retrieve a reset password token without authorization and change the target account’s password, leading to unau...

CVE-2024-24904

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contains a Stored Cross-Site Scripting vulnerability. An adjacent network, high-privileged attacker could store malicious HTML/JavaScript in a trusted data store, causing the browser to execute code in the vulnerable web app context,...

CVE-2024-24905

Dell Secure Connect Gateway (SCG) Policy Manager (all versions) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the inclusion store. An adjacent-network, high-privileged attacker could store malicious HTML/JavaScript, which executes in a victim’s browser in the context of the ...

Cross site scripting

Dell Secure Connect Gateway SCG Policy Manager, all versions, contains a Stored Cross-Site Scripting Vulnerability in Policy page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted...

CVE-2024-24907

Dell Secure Connect Gateway SCG Policy Manager, all versions, contains a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a...

CVE-2024-24907

Dell Secure Connect Gateway (SCG) Policy Manager is affected by a Stored Cross-Site Scripting vulnerability in the Filters page across all versions. The root cause is improper handling/storage of user-supplied data in the data store, allowing an adjacent, high-privilege attacker to inject HTML/Ja...

CVE-2024-24907

Dell Secure Connect Gateway SCG Policy Manager, all versions, contains a Stored Cross-Site Scripting Vulnerability in the Filters page. An adjacent network high privileged attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a...

CVE-2024-24906

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the Policy page. The issue can be exploited by an adjacent-network, high-privileged attacker to store malicious HTML/JavaScript in a trusted data store, leading to e...