Search: 7.3.1.1

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including various LTS releases, contain an SQL Injection vulnerability. This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability does not impact integrity or availability and has a low CVSS score of 2.7.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper authentication vulnerability. This flaw allows an unauthenticated remote attacker to execute arbitrary commands with root privileges, posing a critical risk to system security. Dell recommends upgrading to fixed versions as soon as possible.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper validation of integrity check value vulnerability. This flaw could allow a high privileged attacker with local access to bypass protection mechanisms. The vulnerability is identified as CVE-2026-90720 and has a CVSS v3.1 score of 6.7, indicating a medium severity impact. No public exploits or patches are currently documented.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a high privileged attacker with local access to potentially cause a denial of service. The vulnerability does not impact confidentiality but may affect system availability. The CVSS score is 3.4, indicating a low severity level.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Releases), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS Command Injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS v3.1 base score of 7.2, indicating high severity. No public exploits or patch information are provided in the available data.

The Hustle WordPress plugin, used for email marketing and lead generation, is vulnerable to stored cross-site scripting (XSS) via the 'content[cta_label]' parameter in all versions up to and including 7.8.14.3. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with custom-level access or higher to inject malicious scripts. By default, only administrators have the required capability, but this can be delegated to lower roles such as Subscribers, potentially enabling exploitation by less privileged users.

The Rich Showcase for Google Reviews WordPress plugin up to version 7.1.6 contains an authorization bypass vulnerability. This flaw allows authenticated users with contributor-level access or higher to retrieve a sensitive site-wide authentication secret (grw_auth_code). The secret can be used to impersonate the WordPress site to the plugin's backend service, potentially leading to unauthorized actions. The vulnerability is identified as CVE-2026-110020 and has a CVSS score of 6.5 (medium severity).

The Mage Eventpress plugin for WordPress versions up to and including 5.7.8 contains a privilege escalation vulnerability. This flaw arises from the mep_grant_shop_manager_access() function, which improperly grants the manage_options capability when certain request parameters match specific patterns, without validating them against registered EventPress screens. Authenticated users with Shop Manager-level access or higher can exploit this by appending crafted query parameters to admin URLs, thereby elevating their privileges to Administrator.

The Hustle plugin for WordPress, used for email marketing and lead generation, contains a stored cross-site scripting (XSS) vulnerability in the 'content[title]' parameter. This affects all versions up to and including 7.8.14.3. The flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with custom-level access and the 'Create and Update Modules' capability to inject malicious scripts. This capability is not granted by default and must be explicitly assigned by an administrator via the plugin's permissions settings.

CVE-2026-86390 is a Missing Authorization vulnerability in Dell PowerProtect Data Domain affecting multiple versions including Feature Release 7.7.1.0 through 8.8 and various LTS releases. A low privileged attacker with remote access could exploit this flaw to gain unauthorized access. The vulnerability has a medium severity with a CVSS score of 6.5. Fixed versions are available starting from 8.9.0.0 and certain later LTS patch releases.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain an authentication bypass vulnerability by spoofing. This flaw allows a low privileged remote attacker to potentially cause denial of service. The vulnerability is identified as CWE-290 and has a CVSS score of 6.4 (medium severity). Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS releases, contain a heap-based buffer overflow vulnerability (CWE-122). This flaw can be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain an improper privilege management vulnerability (CWE-269). This flaw allows a high privileged attacker with remote access to potentially elevate their privileges. The vulnerability has a CVSS score of 7.2, indicating high severity. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, 8.3.1.50, and 7.13.1.90 depending on the release branch.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including specific LTS2024, LTS2025, and LTS2026 releases, contain an OS Command Injection vulnerability (CWE-78). A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, 8.3.1.50, and 7.13.1.90 respectively for the affected release lines.

Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.8 and several LTS releases contain an OS Command Injection vulnerability (CWE-78). A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 7.2. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch releases.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and specific LTS releases contain an OS Command Injection vulnerability (CWE-78). This flaw allows a low privileged remote attacker to execute arbitrary OS commands. The vulnerability is rated high severity with a CVSS score of 8.8. Fixed versions include 8.9.0.0 or later and specific later LTS releases.

Red Hat has issued a critical security advisory for webkitgtk4, addressing multiple vulnerabilities in the ANGLE component used by the chromium-browser within WebKitGTK+. These vulnerabilities include out-of-bounds memory access, heap buffer overflows, use-after-free, integer overflows, type confusion, and insufficient validation of untrusted input. The advisory covers a wide range of CVEs spanning from 2024 to 2026. The update is targeted for Red Hat Enterprise Linux 7 Extended Lifecycle Support. No specific affected versions are detailed in the advisory.

OAuthLib contains a vulnerability in its implementation of the OAuth 2.0 device authorization grant (RFC 8628). The token endpoint does not validate the 'device_code' parameter properly, allowing an attacker who knows a valid client ID enabled for the device workflow to obtain a bearer token without a valid device code. This affects OAuthLib versions starting from 10.7.0_3. The vulnerability can lead to unauthorized token issuance, impacting confidentiality and integrity of client sessions.