Dell EMC
97 CVEs across 73 Dell EMC products. Browse Dell EMC vulnerabilities, severities, and proof-of-concept exploits.
Dell EMC products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34462 | High | 8.4 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge of the hard-coded cre… |
CVE-2022-34442 | High | 8.0 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2022-34456 | High | 8.8 | 2023-01-18 | Dell EMC Metro node, Version(s) prior to 7.1, contain a Code Injection Vulnerability. An authenticated nonprivileged attacker could potentially exploit this v… |
CVE-2019-3726 | Medium | 6.7 | 2019-09-24 | An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework… |
CVE-2019-3754 | Medium | 4.7 | 2019-09-03 | Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to… |
CVE-2019-3751 | Medium | 6.4 | 2019-09-03 | Dell EMC Enterprise Copy Data Management (eCDM) versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote… |
CVE-2019-3753 | Medium | 6.5 | 2019-08-20 | Dell EMC PowerConnect 8024, 7000, M6348, M6220, M8024 and M8024-K running firmware versions prior to 5.1.15.2 contain a plain-text password storage vulnerabili… |
CVE-2019-3741 | High | 7.8 | 2019-07-18 | Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s (including the admin privil… |
CVE-2019-3734 | Medium | 5.4 | 2019-07-18 | Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain an improper authorization vulnerability in NAS Server quotas configuration. A remote authen… |
CVE-2019-3737 | High | 7.5 | 2019-06-19 | Dell EMC Avamar ADMe Web Interface 1.0.50 and 1.0.51 are affected by an LFI vulnerability which may allow a malicious user to download arbitrary files from the… |
CVE-2019-3723 | Critical | 9.1 | 2019-06-06 | Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauth… |
CVE-2019-3722 | High | 7.5 | 2019-06-06 | Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injection vulnerability. A… |
CVE-2019-3727 | Medium | 6.4 | 2019-05-15 | Dell EMC RecoverPoint versions prior to 5.1.3 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an OS command injection vulnerability in the installat… |
CVE-2019-3707 | High | 8.6 | 2019-04-26 | Dell EMC iDRAC9 versions prior to 3.30.30.30 contain an authentication bypass vulnerability. A remote attacker may potentially exploit this vulnerability to by… |
CVE-2019-3706 | High | 8.6 | 2019-04-26 | Dell EMC iDRAC9 versions prior to 3.24.24.24, 3.21.26.22, 3.22.22.22 and 3.21.25.22 contain an authentication bypass vulnerability. A remote attacker may poten… |
CVE-2019-3705 | Critical | 9.8 | 2019-04-26 | Dell EMC iDRAC6 versions prior to 2.92, iDRAC7/iDRAC8 versions prior to 2.61.60.60, and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23… |
CVE-2019-3721 | High | 7.5 | 2019-04-25 | Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote unauthenticated at… |
CVE-2019-3720 | Medium | 4.9 | 2019-04-25 | Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain a Directory Traversal Vulnerability. A remote authenticated malicious user wit… |
CVE-2019-3709 | High | 8.3 | 2019-04-17 | IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can trick an admin user to… |
CVE-2019-3708 | High | 8.3 | 2019-04-17 | IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potent… |
CVE-2017-8023 | Critical | 9.8 | 2019-04-01 | EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the Networker Client execution service (nsrexecd) when… |
CVE-2019-3710 | High | 8.1 | 2019-03-28 | Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed… |
CVE-2019-3704 | High | 7.8 | 2019-02-07 | VNX Control Station in Dell EMC VNX2 OE for File versions prior to 8.1.9.236 contains OS command injection vulnerability. Due to inadequate restriction configu… |
CVE-2018-15776 | Medium | 6.4 | 2018-12-13 | Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the s… |
CVE-2018-15774 | Low | 3.8 | 2018-12-13 | Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalat… |
CVE-2018-11077 | Medium | 6.7 | 2018-11-26 | 'getlogs' utility in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1 and 18.1 and Dell EMC Integrated Data Protection Ap… |
CVE-2018-11076 | Medium | 6.5 | 2018-11-26 | Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0 and 7.4.1 and Dell EMC Integrated Data Protection Appliance (IDPA) 2.0 are affected by an inf… |
CVE-2018-11067 | Medium | 6.1 | 2018-11-26 | Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Pro… |
CVE-2018-11066 | Critical | 9.8 | 2018-11-26 | Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.4.0, 7.4.1, 7.5.0, 7.5.1, 18.1 and Dell EMC Integrated Data Pro… |
CVE-2018-15772 | High | 7.1 | 2018-11-13 | Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an uncontrolled resource consumption vulnerability… |
CVE-2018-15771 | Medium | 5.5 | 2018-11-13 | Dell EMC RecoverPoint versions prior to 5.1.2.1 and RecoverPoint for VMs versions prior to 5.2.0.2 contain an information disclosure vulnerability. A malicious… |
CVE-2018-11062 | High | 8.8 | 2018-11-02 | Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts named 'support' and 'admin' that are protected with default passw… |
CVE-2018-15765 | Low | 3.4 | 2018-10-18 | Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure vulnerability. The log file contents store sensitive data inclu… |
CVE-2018-11080 | High | 7.3 | 2018-10-18 | Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains Improper File Permission Vulnerabilities. The application contains multiple configurati… |
CVE-2018-11079 | Medium | 5.5 | 2018-10-18 | Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintex… |
CVE-2018-11064 | High | 7.8 | 2018-10-05 | Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally aut… |
CVE-2018-11072 | High | 7.8 | 2018-10-02 | Dell Digital Delivery versions prior to 3.5.1 contain a DLL Injection Vulnerability. A local authenticated malicious user with advance knowledge of the applica… |
CVE-2018-15764 | Critical | 9.8 | 2018-09-28 | Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution vulnerability due to improper configurations of triggered JMX services. A r… |
CVE-2018-1251 | High | 8.3 | 2018-09-28 | Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains a URL Redirection vulnerability. A remote unauthenticated attacker could potentially ex… |
CVE-2018-1250 | Medium | 6.5 | 2018-09-28 | Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability. A remote authenticated user could potentially ex… |
CVE-2018-1246 | Medium | 4.7 | 2018-09-28 | Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerabili… |
CVE-2018-11071 | High | 7.5 | 2018-09-18 | Dell EMC Isilon OneFS versions 7.1.1.x, 7.2.1.x, 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 and Dell EMC IsilonSD Edge versions 8.0.0.x, 8.0.1.x, 8.1.0… |
CVE-2018-11078 | Medium | 4.0 | 2018-09-11 | Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious user could read from… |
CVE-2018-11070 | Medium | 5.9 | 2018-09-11 | RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS #1 unpadding o… |
CVE-2018-11069 | Medium | 5.9 | 2018-09-11 | RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known as a Bleichenbacher attack on RSA decry… |
CVE-2018-11068 | Medium | 4.6 | 2018-09-11 | RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physical access to the system to recover sens… |
CVE-2018-11065 | Low | 2.7 | 2018-08-24 | The WorkPoint component, which is embedded in all RSA Archer, versions 6.1.x, 6.2.x, 6.3.x prior to 6.3.0.7 and 6.4.x prior to 6.4.0.1, contains a SQL injectio… |
CVE-2018-11061 | Critical | 9.1 | 2018-08-24 | RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulne… |
CVE-2018-11048 | High | 8.1 | 2018-08-10 | Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External… |
CVE-2018-11050 | High | 8.8 | 2018-08-01 | Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over network vulnerability in… |
CVE-2018-11060 | High | 8.8 | 2018-07-24 | RSA Archer, versions prior to 6.4.0.1, contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user could potent… |
CVE-2018-11059 | High | 8.2 | 2018-07-24 | RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user could potentially expl… |
CVE-2018-11052 | Critical | 9.8 | 2018-07-03 | Dell EMC ECS versions 3.2.0.0 and 3.2.0.1 contain an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to… |
CVE-2018-1249 | Medium | 6.5 | 2018-07-02 | Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle atta… |
CVE-2018-1244 | High | 8.8 | 2018-07-02 | Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A re… |
CVE-2018-1243 | High | 7.5 | 2018-07-02 | Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vu… |
CVE-2018-1212 | High | 8.8 | 2018-07-02 | The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A… |
CVE-2018-11053 | Medium | 6.5 | 2018-06-26 | Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission… |
CVE-2018-1242 | Medium | 6.5 | 2018-05-29 | Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability in the Boxmgmt CLI… |
CVE-2018-1241 | High | 8.8 | 2018-05-29 | Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP password in plain-tex… |
CVE-2018-1235 | Critical | 9.8 | 2018-05-29 | Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated… |
CVE-2018-1248 | Medium | 6.1 | 2018-05-08 | RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host header injection vulner… |
CVE-2018-1247 | High | 7.1 | 2018-05-08 | RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin us… |
CVE-2018-1239 | High | 7.2 | 2018-05-08 | Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote applicatio… |
CVE-2018-1183 | Critical | 9.8 | 2018-04-30 | In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VA… |
CVE-2018-1240 | High | 8.0 | 2018-04-18 | Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Lin… |
CVE-2018-1217 | Critical | 9.8 | 2018-04-09 | Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a… |
CVE-2018-1234 | Medium | 5.5 | 2018-03-30 | RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe… |
CVE-2018-1233 | Medium | 6.1 | 2018-03-30 | RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attacke… |
CVE-2018-1232 | High | 7.5 | 2018-03-30 | RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur whe… |
CVE-2018-1238 | High | 7.5 | 2018-03-27 | Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is used for central man… |
CVE-2018-1237 | Critical | 9.8 | 2018-03-27 | Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LIA). This component… |
CVE-2018-1205 | High | 7.5 | 2018-03-27 | Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send spec… |
CVE-2018-1213 | High | 8.8 | 2018-03-26 | Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 and 8.1.0.2 is affec… |
CVE-2018-1204 | Medium | 6.7 | 2018-03-26 | Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a pat… |
CVE-2018-1203 | Medium | 6.7 | 2018-03-26 | In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. In versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0… |
CVE-2018-1202 | Medium | 4.8 | 2018-03-26 | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and version 7.1.1.11 is affected by a cross-site scripting vulner… |
CVE-2018-1201 | Medium | 4.8 | 2018-03-26 | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-sit… |
CVE-2018-1189 | Medium | 4.8 | 2018-03-26 | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-sit… |
CVE-2018-1188 | Medium | 4.8 | 2018-03-26 | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, and versions 7.2.1.x is affected by a cross-site scripting vulner… |
CVE-2018-1187 | Medium | 4.8 | 2018-03-26 | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6 is affected by a cross-site scripting vulnerability in the Network… |
CVE-2018-1186 | Medium | 4.8 | 2018-03-26 | Dell EMC Isilon versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a cross-sit… |
CVE-2018-1211 | High | 7.5 | 2018-03-23 | Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a path traversal vulnerability in its Web server's URI parser which could be used to obtain speci… |
CVE-2018-1221 | High | 8.1 | 2018-03-19 | In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers… |
CVE-2018-1218 | High | 7.5 | 2018-03-19 | In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes a buffer overflow c… |
CVE-2018-1197 | High | 8.5 | 2018-03-19 | In Windows Stemcells versions prior to 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A… |
CVE-2018-1196 | Medium | 5.9 | 2018-03-19 | Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Sp… |
CVE-2018-1195 | High | 8.8 | 2018-03-19 | In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tok… |
CVE-2015-5350 | High | 7.5 | 2018-03-19 | In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By… |
CVE-2014-3626 | High | 7.5 | 2018-03-19 | The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them… |
CVE-2018-1200 | Medium | 6.5 | 2018-03-16 | Apps Manager for PCF (Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5) allows unprivileged remote file read in… |
CVE-2018-1199 | Medium | 5.3 | 2018-03-16 | Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0… |
CVE-2017-8013 | Critical | 9.8 | 2018-03-16 | EMC Data Protection Advisor 6.3.x before patch 67 and 6.4.x before patch 130 contains undocumented accounts with hard-coded passwords and various privileges. A… |
CVE-2017-14384 | Medium | 6.5 | 2018-03-16 | In Dell Storage Manager versions earlier than 16.3.20, the EMConfigMigration service is affected by a directory traversal vulnerability. A remote malicious use… |
CVE-2016-9880 | Critical | 9.8 | 2018-03-16 | The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used… |
CVE-2017-10955 | High | 8.8 | 2017-10-19 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection Advisor 6.3.0. Authentication is requir… |
CVE-2016-5685 | High | 8.8 | 2016-11-29 | Dell iDRAC7 and iDRAC8 devices with firmware before 2.40.40.40 allow authenticated users to gain Bash shell access through a string injection. |