Threat Intelligence Database

Dell Container Storage Modules versions prior to 1.18.0 have a critical vulnerability due to missing authentication for a critical function. This flaw allows an unauthenticated remote attacker to potentially elevate privileges, impacting confidentiality, integrity, and availability. The vulnerability is identified as CWE-306 and carries a CVSS 3.1 score of 10.0, indicating critical severity.

Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to storage backend administrator credentials for all registered storage arrays.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged local attacker to potentially elevate their privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. No official patch or remediation details are provided in the input data.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of phishing attacks, and Protection mechanism bypass.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 have an initialization vulnerability where a resource is set with an insecure default. This flaw could allow a high privileged attacker with remote access to elevate privileges, tamper with information, bypass protection mechanisms, and gain unauthorized access. The CVSS score is 3.8, indicating a low severity risk. No patch information is provided, and no known exploits are reported in the wild.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 and prior to 5.36 contain a vulnerability where code is downloaded without an integrity check. This flaw could allow an unauthenticated remote attacker to execute code, disclose information, tamper with data, or bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 4.7. No official patch or remediation details are provided in the available data.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 and prior to 5.36 contain an improper certificate validation vulnerability (CWE-295). This flaw allows an unauthenticated attacker with adjacent network access to potentially cause information disclosure, information tampering, and bypass protection mechanisms. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity).

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.

Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell Trusted Device Client versions prior to 8.1.359.0 have an incorrect permission assignment vulnerability. This flaw allows a low privileged local attacker to tamper with information. The vulnerability does not require user interaction and affects confidentiality and integrity but not availability. It has a high severity score of 7.1.

Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.