Threat database

Dell PowerPath versions 7.2 through 8.0 SP1 contain an improper privilege management vulnerability (CWE-269) that allows a low privileged local attacker to potentially elevate their privileges. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or remediation information is currently provided.

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Dell OpenManage Enterprise versions prior to 4.7.0 contain a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability allows a low privileged attacker with remote access to potentially cause information exposure. The vulnerability has a medium severity rating with a CVSS score of 4.6. No patch or remediation information is currently provided.

Dell OpenManage Enterprise versions prior to 4.7.0 contain a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-54794). This vulnerability allows an unauthenticated remote attacker to potentially cause information exposure. The vulnerability has a high severity rating with a CVSS score of 7.2. No patch or remediation details are provided in the available data.

Dell OpenManage Enterprise versions prior to 4.7.0 contain a path traversal vulnerability (CWE-22) that allows a low privileged remote attacker to potentially expose sensitive information. The vulnerability does not impact integrity or availability but can lead to information disclosure. The CVSS 3.1 base score is 6.5, indicating a medium severity risk.

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an XML External Entity (XXE) vulnerability (CWE-611). This flaw allows a low privileged remote attacker to potentially cause information exposure. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. No official patch or remediation details are provided in the input data.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an SQL Injection vulnerability (CWE-89). This flaw allows a low privileged remote attacker to potentially execute script injection. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity. No official patch or remediation details are provided in the input data.

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an improper privilege management vulnerability (CWE-269) that could allow a high privileged attacker with remote access to elevate their privileges. The vulnerability has a CVSS 3.1 score of 7.2, indicating a high severity impact on confidentiality, integrity, and availability.

Dell OpenManage Enterprise versions prior to 4.7.0 contain an OS Command Injection vulnerability (CWE-78). This flaw allows a high privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability is identified as CVE-2026-54796 and has a CVSS score of 7.2, indicating high severity.

Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 have a least privilege violation vulnerability (CWE-272) that allows a low privileged local attacker to potentially elevate their privileges. This vulnerability is rated high severity with a CVSS score of 7.3. No official patch or remediation details are provided in the input data.

Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 have a vulnerability involving improper link resolution before file access. This flaw allows a low privileged local attacker to exploit link following issues, potentially causing denial of service and elevation of privileges. The vulnerability is classified under CWE-272 (Least Privilege Violation).

Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version 10.3.0, Dell Unity Version 5.4, Dell PowerFlex Manager Version 4.5.4, Dell PowerFlex Intelligent Catalog Versions 46.377.00 and 46.382.00 and Dell PowerFlex Rack version 4.5.4 and prior versions, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass.

CVE-2026-70415 is a high-severity buffer overflow vulnerability in Dell PowerStore 500T's NFS/RPC component. It allows an unauthenticated remote attacker to potentially execute commands or cause denial of service by exploiting improper input size checking during buffer copy operations.

Dell PowerStore 500T contains a critical out-of-bounds write vulnerability in its SMB/CIFS implementation. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted SMB packet, potentially causing a persistent denial of service or enabling remote code execution. The vulnerability is identified as CWE-787 and has a CVSS score of 9.8, indicating high severity. No patch information is provided in the available data.

CVE-2026-61407 is a high-severity vulnerability in Dell Watchdog Timer Driver versions prior to 2.0.0.1. It involves an exposed IOCTL interface with insufficient access control, allowing a low privileged local attacker to potentially escalate privileges. The vulnerability is categorized as Execution After Redirect (EAR) under CWE-698. No official patch or remediation details are provided in the available data.

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into Log File vulnerability in the svc_tools. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.