Threat database

Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability, leading to a targeted application user being redirected to arbitrary web URLs. The vulnerability could be leveraged by attackers to conduct phishing attacks that cause users to divulge sensitive information.

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information tampering.

Dell PowerFlex Manager Appliance versions up to 4.6.2 contain a vulnerability related to insecure storage of sensitive information. This flaw allows an unauthenticated attacker with local access to potentially access sensitive data without authorization. The vulnerability does not require user interaction and has a medium severity rating based on a CVSS score of 4. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Dell SmartFabric Storage Software versions prior to 1.4.5 contain a command injection vulnerability (CWE-77) that allows a high privileged local attacker to execute arbitrary commands. Exploitation could lead to unauthorized filesystem access. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

Dell Live Optics Windows and Personal Edition collectors have an improper certificate validation vulnerability (CWE-295). This flaw could allow a remote unauthenticated attacker to compromise confidentiality and integrity by exploiting the certificate validation weakness. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

Dell PowerScale InsightIQ versions 5.0.0 through 6.2.0 have a vulnerability involving execution with unnecessary privileges. This flaw allows a high privileged attacker with local access to potentially elevate their privileges further. The vulnerability is identified as CWE-250 and has a CVSS score of 6.7, indicating a medium severity level. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper privilege management vulnerability in the OS. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

CVE-2025-43992 is a medium severity vulnerability affecting Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0.

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.

Dell Automation Platform versions prior to 2.0.0.0 contain a missing authorization vulnerability (CWE-862) that allows a low privileged attacker with remote access to potentially elevate their privileges. The vulnerability has a high severity with a CVSS score of 8. No official patch or remediation guidance has been provided yet. There are no known exploits in the wild at this time.

Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Arbitrary File Write

Dell iDRAC10 versions 1.20.70.50 and 1.30.05.10 have an Insufficiently Protected Credentials vulnerability due to a race condition. This flaw allows an authenticated low-privileged attacker to potentially gain elevated access. The vulnerability is tracked as CVE-2026-35155 and has a CVSS score of 7.1, indicating high severity.

Dell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.

Dell Alienware Command Center (AWCC) versions prior to 6.13.8.0 contain a least privilege violation vulnerability (CWE-272) that allows a low privileged local attacker to potentially elevate their privileges. The vulnerability has a CVSS v3.1 score of 5.3, indicating a medium severity level. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported. The vulnerability requires local access and high attack complexity, with no user interaction needed. Confidentiality is not impacted, but integrity and availability impacts are rated high and low respectively.