Search: 7.3.1.1

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and specified LTS releases contain an authentication bypass vulnerability. This flaw allows a low privileged remote attacker to spoof authentication, potentially causing denial of service. The vulnerability does not impact confidentiality but can affect integrity and availability.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS Command Injection vulnerability. A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 7.2, indicating high severity. No information about patches or fixes is provided in the data. No known exploits in the wild have been reported.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially gain unauthorized access to the system. The vulnerability is identified as CWE-862 and has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. No public exploits or known exploitation in the wild have been reported. Patch or remediation details are not provided in the available data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with remote access to potentially elevate their privileges further. The vulnerability is identified as CWE-269 and has a CVSS v3.1 score of 7.2, indicating a high severity impact on confidentiality, integrity, and availability. No public exploits or patches are currently documented in the provided data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could exploit this flaw to expose credentials, potentially allowing access to the system with the privileges of the compromised user. The vulnerability is rated critical with a CVSS score of 9.8.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, and specific LTS2024, LTS2025, and LTS2026 release versions contain a path traversal vulnerability. This flaw allows an unauthenticated remote attacker to potentially access the filesystem. The vulnerability is identified as CWE-22 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability. This flaw allows a low privileged remote attacker to potentially disclose information. The vulnerability does not impact integrity or availability and has a medium severity rating.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an integer overflow or wraparound vulnerability. A high privileged attacker with remote access could exploit this flaw to achieve code execution. The vulnerability is tracked as CVE-2026-86389 and has a CVSS 3.1 base score of 7.2, indicating high severity. No patch or remediation information is provided in the available data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 contain an improper check for dropped privileges vulnerability. This flaw allows a low privileged attacker with remote access to potentially elevate their privileges. The vulnerability is rated high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a high privileged attacker with remote access to potentially disclose sensitive information. The vulnerability is identified as CWE-22 and has a CVSS 3.1 base score of 6.8, indicating medium severity.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including LTS2024, LTS2025, and LTS2026 release versions, contain an OS command injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CVE-2026-86379 and has a CVSS score of 7.2, indicating high severity.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an integer overflow or wraparound vulnerability. This flaw could allow a high privileged remote attacker to bypass protection mechanisms. The vulnerability has a CVSS score of 7.2, indicating high severity. No public exploits or patches are currently documented.

CVE-2026-118039 is an XML External Entity (XXE) vulnerability in Progress Software's Telerik Document Processing Libraries prior to version 2026.3.1027. The flaw occurs in SVG image processing, allowing an unauthenticated attacker to exploit crafted SVG images with nested embedded SVGs to read local files on the server during image processing or PDF export. This vulnerability has a high severity score of 7.5 and enables unauthorized disclosure of sensitive information without requiring user interaction or privileges.

CVE-2026-99178 is a vulnerability in the Linux kernel's x86 KVM subsystem involving improper handling of asynchronous page fault (async #PF) flags during nested machine check or debug exceptions in non-maskable interrupt (NMI) context. This flaw can cause a kernel panic when an async page fault is consumed incorrectly in NMI context, leading to host crashes under specific workloads such as KVM virtualization with async page fault delivery and perf sampling. The issue has been fixed in Linux kernel versions 6.18.59 and 7.2.13 and later.

CVE-2026-99124 is a vulnerability in the Linux kernel's s390/pci subsystem where uninitialized kernel data can leak in an SCLP report due to improper buffer length validation. The flaw allows an out-of-bounds read of up to around 4KB of kernel memory when user-space provides a short buffer with a larger claimed report length. The issue affects Linux kernel version 4.7 and has been fixed in several subsequent commits. The leak is limited to privileged entities that can already access the memory page containing the report, reducing the risk of sensitive data exposure.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS releases, contain an OS Command Injection vulnerability (CWE-78). A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 7.2. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.

CVE-2026-101274 is a vulnerability in pretix's Single-Sign-On (SSO) implementation where the system fails to properly validate the response_type parameter against the configured grant type for an SSO client. This allows an attacker to receive a valid token with an unauthorized response_type if they can run JavaScript on a trusted redirect URI page. The issue affects multiple pretix versions prior to fixed releases in 2026.6.4, 2026.7.3, and 2026.8.1.

A vulnerability in pretix API endpoints allowed unauthorized referencing of gift cards by exploiting predictable internal IDs. Attackers could create payments linked to gift cards from other organizers without charging the gift card, then trigger refunds to increase the gift card's value. This flaw affects multiple versions of pretix prior to fixed releases in 2026.6.4, 2026.7.3, and 2026.8.1.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a critical SQL Injection vulnerability (CWE-89). This flaw allows a low privileged attacker with remote access to potentially execute unauthorized SQL commands, leading to unauthorized access to managed systems. The vulnerability is addressed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS releases, contain an improper authentication vulnerability (CWE-287). This flaw allows a low privileged remote attacker to potentially bypass protection mechanisms. The vulnerability is rated high severity with a CVSS score of 8.3. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.