Threat database

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.

Dell OpenManage Server Administrator Managed Node for Windows versions prior to 11.1.0.2 contains a relative path traversal vulnerability (CWE-23). This flaw allows a low privileged attacker with remote access to potentially access the filesystem. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No official patch or remediation guidance has been provided yet by Dell. There are no known exploits in the wild at this time.

Dell OpenManage Server Administrator Managed Node for Windows versions prior to 11.1.0.2 contains an improper authentication vulnerability (CWE-287). This flaw allows an unauthenticated remote attacker to potentially gain unauthorized access. The vulnerability has a high severity rating with a CVSS score of 7.7. No official patch or remediation guidance has been provided yet by the vendor.

Dell Virtual Storage Integrator for VMware vSphere Client versions prior to 10.11.1.0 contain a critical vulnerability that allows unauthenticated remote attackers to disclose sensitive information. Exploitation can lead to session hijacking, enabling attackers to impersonate authenticated users, including administrators. Dell recommends upgrading to version 10.11.1.0 or later to address this issue.

Dell Virtual Storage Integrator for VMware vSphere Client versions prior to 10.11.1.0 contain a critical OS Command Injection vulnerability in the IAPI component. This flaw allows a remote unauthenticated attacker to execute arbitrary OS commands with root privileges, potentially leading to full system compromise. Dell recommends upgrading to a fixed version as soon as possible.

Dell RVTools versions prior to 4.8.1 contain an improper certificate validation vulnerability in the collector component. This vulnerability could allow a remote unauthenticated attacker to compromise confidentiality and integrity. The CVSS score is 6.8, indicating a medium severity issue. No official patch or remediation guidance has been provided yet by Dell. There are no known exploits in the wild at this time.

Dell Display and Peripheral Manager (DDPM Mac) versions prior to 2.3.0.1005 have a vulnerability due to missing authentication for a critical function. This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability is identified as CWE-306 and has a high severity rating with a CVSS score of 7.8.

Dell Display and Peripheral Manager (DDPM Mac) versions prior to 2.3.0.1005 contain an improper access control vulnerability. This flaw allows a low privileged local attacker to potentially elevate privileges and execute arbitrary code. The vulnerability is identified as CWE-284 and has a high severity rating with a CVSS score of 7.8. No official patch or remediation guidance has been provided yet by the vendor.

Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.