Search: 7.3.1.1

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain a missing authorization vulnerability (CWE-862). This flaw allows a low privileged attacker with remote access to potentially perform unauthorized system operations on managed systems. The vulnerability has a critical severity with a CVSS score of 9.6. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a stack-based buffer overflow vulnerability (CWE-121). This flaw allows an unauthenticated remote attacker to potentially execute arbitrary commands on the affected system. The vulnerability is critical with a CVSS score of 9.8. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.

CVE-2025-30414 is a local privilege escalation vulnerability in Acronis Cyber Protect Cloud Agent and Acronis Cyber Protect 17 for Windows. It arises from weak authentication mechanisms allowing improper access. The issue affects versions before build 42569 for the Cloud Agent and before build 42587 for Cyber Protect 17. The vulnerability has a high severity rating with a CVSS score of 7.1.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain an out-of-bounds write vulnerability (CWE-787). A low privileged attacker with remote access could exploit this flaw to cause a denial of service. The vulnerability has a high severity with a CVSS score of 7.6. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 respectively.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a stack-based buffer overflow vulnerability (CWE-121). This flaw allows a low privileged attacker with remote access to potentially gain unauthorized access. The vulnerability has a high severity with a CVSS score of 8.8. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain an OS Command Injection vulnerability (CWE-78). This flaw allows a high privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability has a high severity with a CVSS score of 7.2. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release line.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including several LTS releases, contain an integer overflow or wraparound vulnerability (CWE-190). This flaw could allow a high privileged attacker with remote access to bypass protection mechanisms. The vulnerability has a high severity with a CVSS score of 7.2. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS2025 and LTS2026 releases, contain a path traversal vulnerability (CWE-22). This flaw allows a high privileged remote attacker to potentially disclose sensitive information by bypassing directory restrictions. The vulnerability has a CVSS 3.1 base score of 6.8, indicating medium severity. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, and 8.3.1.50 respectively.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a vulnerability involving the use of a hard-coded cryptographic key. This flaw allows an unauthenticated remote attacker to potentially expose credentials, which could then be used to access the system with the privileges of the compromised user. The vulnerability has a critical severity rating with a CVSS score of 9.8. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 contain a vulnerability due to improper checking for dropped privileges. This flaw could allow a low privileged remote attacker to elevate their privileges on the affected system. The vulnerability is identified as CWE-273 and has a high severity rating with a CVSS score of 8.8. A fix is available starting from version 8.9.0.0.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a SQL Injection vulnerability (CWE-89). This flaw allows a low privileged remote attacker to potentially disclose information by exploiting improper neutralization of special elements in SQL commands. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a path traversal vulnerability (CWE-22) that allows an unauthenticated remote attacker to access the filesystem. This vulnerability is fixed in versions 8.9.0.0 or later and other specified LTS versions. The CVSS 3.1 score is 5.3 (medium severity).

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS2024, LTS2025, and LTS2026 release versions, contain a vulnerability involving allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability has a medium severity rating and a CVSS score of 5.3. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 respectively for the affected release lines.

A vulnerability in Go's crypto/x509 package used by Red Hat's Service Telemetry Framework (STF) allows man-in-the-middle attacks via untrusted intermediate certificates. The certificate verification process fails to block trust in intermediate certificates from compromised Certificate Authorities, enabling attackers to impersonate legitimate servers during secure connections. This flaw affects Go-based clients or servers relying on standard certificate verification and requires specific network positioning and attacker-controlled certificates. Red Hat has released STF components version 1.5.7 to address this issue.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS releases, contain an integer overflow or wraparound vulnerability. This flaw could be exploited by a high privileged attacker with remote access to execute arbitrary code on the affected system. The vulnerability is tracked as CVE-2026-86389 and has a CVSS 3.1 score of 7.2, indicating high severity. Fixed versions are available starting from 8.9.0.0 and later, as well as specific later versions of LTS releases.

The Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin is vulnerable to reflected cross-site scripting (XSS) via the 'l10n_print_after' parameter in all versions up to and including 4.7. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires the targeted site to have at least one Contact Form 7 form configured with a [multistep] form-tag, as version 4.7 introduced canonicalization that blocks the attack on non-multistep forms.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a low privileged remote attacker to potentially access the filesystem beyond intended restrictions. The vulnerability is identified as CWE-22 and has a high severity CVSS score of 8.8. No patch or remediation information is provided in the data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper authentication vulnerability. This flaw allows an unauthenticated remote attacker to potentially create privileged accounts, leading to full system compromise. The vulnerability is rated critical with a CVSS score of 9.8. Dell recommends upgrading to fixed versions as soon as possible.

Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.8, and specific LTS2024, LTS2025, and LTS2026 release versions contain an OS Command Injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 7.2, indicating high severity.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including various LTS releases, contain an SQL Injection vulnerability. This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability does not impact integrity or availability and has a low CVSS score of 2.7.