Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (appliance) and 5.36.00.00 (application) contain a Relative Path Traversal vulnerability (CWE-23). This flaw allows a low privileged attacker with remote access to potentially execute remote code. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.
Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (Appliance) and 5.36.00.00 (Application) contain a path traversal vulnerability (CWE-22). This flaw allows an unauthenticated remote attacker to potentially execute remote code by exploiting improper limitation of pathname to restricted directories. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No official patch or remediation details are provided in the available data. No known exploits in the wild have been reported.
Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions prior to 5.36.00.16 and 5.36.00.00 respectively contain an improper certificate validation vulnerability. This flaw could allow an unauthenticated remote attacker to gain unauthorized access. The vulnerability is rated high severity with a CVSS score of 7.4. No official patch or vendor advisory details are provided in the input data.
Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (Appliance) and 5.36.00.00 (Application) contain a critical vulnerability allowing execution with unnecessary privileges. An unauthenticated local attacker with SSH access can exploit the exposed Docker socket to gain root-level access without a password. Additionally, compromising a service inside the orchestrator container enables container escape and host-level control. Dell recommends upgrading to fixed versions to mitigate this risk.
Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application versions prior to 5.36.00.16 and 5.36.00.00 respectively contain an improper privilege management vulnerability. This flaw allows a low privileged attacker with local access to potentially elevate their privileges. The vulnerability has a medium severity with a CVSS score of 5.5. No public exploits or vendor patch information is currently provided.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 contain a vulnerability due to missing authentication for a critical function. This flaw allows an unauthenticated remote attacker to potentially gain unauthorized access. The vulnerability is rated high severity with a CVSS score of 8.1, indicating significant confidentiality, integrity, and availability impacts. No patch or remediation information is provided in the available data.
Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 for the appliance and prior to 5.36.00.00 for the application contain a relative path traversal vulnerability. This flaw allows an unauthenticated remote attacker to potentially execute code remotely by exploiting the path traversal issue. The vulnerability is rated high severity with a CVSS score of 7.4.
Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (appliance) and 5.36.00.00 (application) contain a vulnerability due to the use of hard-coded credentials. This flaw allows an unauthenticated remote attacker to potentially gain unauthorized access to the system. The vulnerability is identified as CWE-798 and has a high severity rating with a CVSS score of 7.7.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. This vulnerability is considered critical because it allows an attacker to execute commands remotely on a target system by sending a specially crafted request to the application, bypassing intended restrictions on code execution.Dell recommends customers to upgrade at the earliest opportunity.
Dell Secure Connect Gateway (SCG) 5.0 Application versions prior to 5.36.00.00 contain an OS Command Injection vulnerability (CWE-78). This vulnerability allows an unauthenticated remote attacker to potentially execute arbitrary OS commands. The vulnerability has a high severity with a CVSS score of 7.3. No patch or remediation details are currently provided by the vendor.
Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks.
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass.
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access.