Multiple vulnerabilities in Dell products

1) Information disclosure

EUVDB-ID: #VU62990

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26933

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows NTFS. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65172

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22050

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Fax Service, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU65210

Risk: Low

CVSSv3.1: 4.5 [CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22711

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows BitLocker. A local attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Race condition

EUVDB-ID: #VU62956

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23270

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to a race condition in Point-to-Point Tunneling Protocol. A remote attacker can send a specially crafted connection request to a RAS server and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Type Confusion

EUVDB-ID: #VU65219

Risk: Low

CVSSv3.1: 2.2 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23816

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a branch type confusion. A local user can force the branch predictor to predict the wrong branch type and gain access to sensitive information.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Type Confusion

EUVDB-ID: #VU65204

Risk: Low

CVSSv3.1: 2.2 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23825

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to a branch type confusion. A local user can force the branch predictor to predict the wrong branch type and gain access to sensitive information.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Security features bypass

EUVDB-ID: #VU62989

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26913

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Windows Authentication. A remote attacker can bypass the target application

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU62952

Risk: Medium

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2022-26923

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Active Directory Domain Services, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

9) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU62921

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2022-26925

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists within the Windows LSA service. A remote attacker can call a method on the LSARPC interface and coerce the domain controller to authenticate to the attacker using NTLM. As a result, an attacker can obtain credentials and compromise the affected system via the NTLM Relay Attack.

Note, the vulnerability is being actively exploited in the wild.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

10) Input validation error

EUVDB-ID: #VU62971

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26926

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Address Book. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU62950

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26927

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Graphics Component. A remote attacker can trick a victim to open a specially crafted file or visit a malicious website and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Information disclosure

EUVDB-ID: #VU62960

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26930

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Remote Access Connection Manager. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU62972

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26931

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Kerberos, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Information disclosure

EUVDB-ID: #VU62949

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26934

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Graphics Component. A remote attacker can trick a victim to open a specially crafted file and gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Security features bypass

EUVDB-ID: #VU65216

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22048

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to security feature bypass issue in BitLocker. An attacker with physical access can bypass the BitLocker Device Encryption feature on the system storage device and gain access to encrypted data.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Information disclosure

EUVDB-ID: #VU62954

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26935

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows WLAN AutoConfig Service. A remote attacker on the local network can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Information disclosure

EUVDB-ID: #VU62976

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26936

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Server Service. A remote user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Information disclosure

EUVDB-ID: #VU62644

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27776

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to curl can leak authentication or cookie header data during HTTP redirects to the same host but another port number. When asked to send custom headers or cookies in its HTTP requests, curl sends that set of headers only to the host which name is used in the initial URL, so that redirects to other hosts will make curl send the data to those. However, due to a flawed check, curl wrongly also sends that same set of headers to the hosts that are identical to the first one but use a different port number or URL scheme.

The vulnerability exists due to an incomplete fix for #VU10224 (CVE-2018-1000007).

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU62959

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29103

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Remote Access Connection Manager, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU62941

Risk: Low

CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2022-29104

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

21) Input validation error

EUVDB-ID: #VU62961

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29105

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft Windows Media Foundation. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Information disclosure

EUVDB-ID: #VU62948

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29112

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Graphics Component. A remote attacker can trick a victim to open a specially crafted file and gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Race condition

EUVDB-ID: #VU62947

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29113

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Windows Digital Media Receiver. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Path traversal

EUVDB-ID: #VU62942

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29114

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to path traversal in Windows Print Spooler. A local user can gain obtain contents of arbitrary files on the system and view them with SYSTEM privileges.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Input validation error

EUVDB-ID: #VU62946

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29115

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Fax Service. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Input validation error

EUVDB-ID: #VU62953

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29121

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Windows WLAN AutoConfig Service. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Race condition

EUVDB-ID: #VU62945

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29125

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Windows Push Notifications Apps. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65170

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22049

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows CSRSS, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Buffer overflow

EUVDB-ID: #VU65161

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2022-22047

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Microsoft Windows Client/Server Runtime Subsystem (CSRSS). A local user can run a specially crafted program to execute arbitrary code with SYSTEM privileges.

Note, the vulnerability is being actively exploited in the wild.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

30) Security features bypass

EUVDB-ID: #VU62992

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29127

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a local attacker to gain access to sensitive information.

The vulnerability exists due to an error in BitLocker. An attacker with physical access can gain access to encrypted data.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Input validation error

EUVDB-ID: #VU62969

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22019

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Remote Procedure Call Runtime. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Information disclosure

EUVDB-ID: #VU64364

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21123

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists in Intel processors due to excessive data output when DirectPath I/O (PCI-Passthrough) is utilized. An attacker (both local and remote) with administrative access to a virtual machine that has an attached DirectPath I/O (PCI-Passthrough) device can obtain information stored in physical memory about the hypervisor or other virtual machines that reside on the same host.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Information disclosure

EUVDB-ID: #VU64365

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21125

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists in Intel processors due to excessive data output when DirectPath I/O (PCI-Passthrough) is utilized. An attacker (both local and remote) with administrative access to a virtual machine that has an attached DirectPath I/O (PCI-Passthrough) device can obtain information stored in physical memory about the hypervisor or other virtual machines that reside on the same host.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Incomplete cleanup

EUVDB-ID: #VU64376

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21127

CWE-ID: CWE-459 - Incomplete cleanup

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information on the system.

The vulnerability exists due to incomplete cleanup in specific special register read operations. A local user can enable information disclosure.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Information disclosure

EUVDB-ID: #VU64366

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21166

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows an attacker to gain access to potentially sensitive information.

The vulnerability exists in Intel processors due to excessive data output when DirectPath I/O (PCI-Passthrough) is utilized. An attacker (both local and remote) with administrative access to a virtual machine that has an attached DirectPath I/O (PCI-Passthrough) device can obtain information stored in physical memory about the hypervisor or other virtual machines that reside on the same host.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Information disclosure

EUVDB-ID: #VU65196

Risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21845

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Kernel. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Race condition

EUVDB-ID: #VU62955

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21972

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to a race condition in Point-to-Point Tunneling Protocol. A remote attacker can send a specially crafted connection request to a RAS server and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Information disclosure

EUVDB-ID: #VU62951

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22011

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Graphics Component. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Input validation error

EUVDB-ID: #VU62931

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22012

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP if the MaxReceiveBuffer LDAP policy is set to a value higher than the default value. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Input validation error

EUVDB-ID: #VU62930

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22013

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Input validation error

EUVDB-ID: #VU62929

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22014

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Information disclosure

EUVDB-ID: #VU62979

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22015

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Remote Desktop Protocol (RDP). A remote user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Race condition

EUVDB-ID: #VU62970

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22016

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Windows PlayToManager. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65188

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22022

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65191

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22045

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows.Devices.Picker.dll, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Security features bypass

EUVDB-ID: #VU65215

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22023

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a local user to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Windows Portable Device Enumerator Service. An authenticated attacker with physical access can bypass the target application.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Input validation error

EUVDB-ID: #VU65193

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22024

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Fax Service. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Input validation error

EUVDB-ID: #VU65189

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22025

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Internet Information Services Cachuri Module. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65169

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22026

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows CSRSS, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Input validation error

EUVDB-ID: #VU65171

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22027

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Fax Service. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65176

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22031

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Credential Guard Domain-joined Public Key, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Use-after-free

EUVDB-ID: #VU65177

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22034

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in multiple methods within the win32kfull driver in Microsoft Windows. A local user can run a specially crafted program to trigger a use-after-free error and execute arbitrary code with SYSTEM privileges.

List of vulnerable methods:

• UMPDDrvStretchBltROP
• UMPDDrvAlphaBlend
• UMPDDrvCopyBits
• UMPDDrvStretchBlt
• UMPDDrvPlgBlt
• UMPDDrvTransparentBlt
• UMPDDrvBitBlt
• UMPDDrvStrokePath
• UMPDDrvGradientFill
• UMPDDrvTextOut

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65179

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22036

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Performance Counters for Windows, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65180

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22037

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Advanced Local Procedure Call, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Input validation error

EUVDB-ID: #VU65183

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22038

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Remote Procedure Call Runtime. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Input validation error

EUVDB-ID: #VU65184

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22040

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Internet Information Services Dynamic Compression Module. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65185

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22041

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote administrator to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65192

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22043

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Fast FAT File System Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Race condition

EUVDB-ID: #VU62944

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29126

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Tablet Windows User Interface Application Core. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Input validation error

EUVDB-ID: #VU62922

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29128

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Input validation error

EUVDB-ID: #VU65178

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30221

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Graphics Component. A remote attacker can trick a victim to connect to a malicious RDP server and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU64369

Risk: Low

CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2022-30166

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Local Security Authority Subsystem Service, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

63) OS Command Injection

EUVDB-ID: #VU63784

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2022-30190

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing URL within the Microsoft Windows Support Diagnostic Tool (MSDT). A remote unauthenticated attacker can trick the victim to open a specially crafted file, which calls the ms-msdt tool and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

UPDATED

The vulnerability resides within MSTD and not in Microsoft Word. Microsoft Word is an attack vector and not the source of vulnerability.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

64) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65181

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30202

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Advanced Local Procedure Call, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Security features bypass

EUVDB-ID: #VU65214

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30203

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a local user to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Windows Boot Manager. An authenticated attacker with physical access can bypass Secure Boot

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65203

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30205

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote administrator to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Group Policy, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65186

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-30206

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

68) Input validation error

EUVDB-ID: #VU65202

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30208

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Security Account Manager (SAM). A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65201

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30209

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows IIS Server, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Input validation error

EUVDB-ID: #VU65200

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30211

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Layer 2 Tunneling Protocol (L2TP). A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Race condition

EUVDB-ID: #VU65199

Risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30212

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information on the system.

The vulnerability exists due to a race condition in Windows Connected Devices Platform Service. A local user can exploit the race and gain unauthorized access to sensitive information.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Information disclosure

EUVDB-ID: #VU65198

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30213

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows GDI+. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65190

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30220

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Common Log File System Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Input validation error

EUVDB-ID: #VU65195

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30222

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Shell. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Security features bypass

EUVDB-ID: #VU64375

Risk: Low

CVSSv3.1: 7.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30164

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a local user to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Kerberos AppContainer. A local user can bypass the target application.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65182

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30224

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Advanced Local Procedure Call, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65194

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30225

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Media Player Network Sharing Service, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU65187

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30226

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Input validation error

EUVDB-ID: #VU64372

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-32230

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Windows SMB. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Improper input validation

EUVDB-ID: #VU65497

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21540

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Improper input validation

EUVDB-ID: #VU65496

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21541

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Improper input validation

EUVDB-ID: #VU65498

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21549

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Deserialization of Untrusted Data

EUVDB-ID: #VU64152

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-25647

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to insecure input validation when processing serialized data passed to writeReplace() method. A remote attacker can pass specially crafted data to the application and perform a denial of service attack.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Improper input validation

EUVDB-ID: #VU65495

Risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-34169

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a remote non-authenticated attacker to compromise the affected system.

The vulnerability exists due to an integer truncation issue when processing malicious XSLT stylesheets. A remote non-authenticated attacker can pass specially crafted data to the application to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

85) OS Command Injection

EUVDB-ID: #VU62765

Risk: Medium

CVSSv3.1: 7.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-1292

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the c_rehash script distributed by some operating systems. A remote attacker with ability to pass data to c_rehash script can and execute arbitrary OS commands with the privileges of the script.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

86) OS Command Injection

EUVDB-ID: #VU64559

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-2068

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the c_rehash script distributed by some operating systems. A remote attacker with ability to pass data to c_rehash script can and execute arbitrary OS commands with the privileges of the script.

The vulnerability exists due to incomplete fix for #VU62765 (CVE-2022-1292).

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU64368

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30165

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Kerberos, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Information disclosure

EUVDB-ID: #VU64348

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30162

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Kernel. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Input validation error

EUVDB-ID: #VU62926

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29129

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Input validation error

EUVDB-ID: #VU64295

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30140

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows iSCSI Discovery Service. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Input validation error

EUVDB-ID: #VU62925

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29130

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP if the MaxReceiveBuffer LDAP policy is set to a value higher than the default value. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Input validation error

EUVDB-ID: #VU62924

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29131

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU62940

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29132

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Input validation error

EUVDB-ID: #VU62923

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29137

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Input validation error

EUVDB-ID: #VU62928

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29139

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP. A remote attacker can trick a victim to connect a Lightweight Directory Access Protocol (LDAP) client to a malicious LDAP server and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Path traversal

EUVDB-ID: #VU62943

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29140

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Input validation error

EUVDB-ID: #VU62927

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29141

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows LDAP. A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Race condition

EUVDB-ID: #VU62965

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29142

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Windows Kernel. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU64290

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30131

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Container Isolation FS Filter Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU64291

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30132

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Container Manager Service, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Buffer overflow

EUVDB-ID: #VU63129

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30138

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in Microsoft Windows Print Spooler service within the issuance of certificates. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Input validation error

EUVDB-ID: #VU64298

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30139

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Lightweight Directory Access Protocol (LDAP). A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Input validation error

EUVDB-ID: #VU64300

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30141

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Lightweight Directory Access Protocol (LDAP). A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Input validation error

EUVDB-ID: #VU64297

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30161

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Lightweight Directory Access Protocol (LDAP). A remote attacker can trick a victim to connect to a malicious LDAP server and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Input validation error

EUVDB-ID: #VU64296

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30142

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbizrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows File History. A remote user can trick a victim to connect to a malicious remote share and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Input validation error

EUVDB-ID: #VU64302

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30143

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Lightweight Directory Access Protocol (LDAP). A remote user can trick a victim to connect to a malicious LDAP server and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Input validation error

EUVDB-ID: #VU64326

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30145

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Encrypting File System (EFS). A remote user can pass specially crafted input to the application and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Input validation error

EUVDB-ID: #VU64299

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30146

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Lightweight Directory Access Protocol (LDAP). A remote attacker can trick a victim to connect to a malicious LDAP server and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU64367

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30147

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Installer, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Information disclosure

EUVDB-ID: #VU64327

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30148

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Desired State Configuration (DSC). A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Input validation error

EUVDB-ID: #VU64304

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30149

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Lightweight Directory Access Protocol (LDAP). A remote user can trick a victim to connect to a malicious LDAP server and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU64328

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30150

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Defender Remote Credential Guard, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Race condition

EUVDB-ID: #VU64335

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30151

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Windows Ancillary Function Driver for WinSock. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Input validation error

EUVDB-ID: #VU64338

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30152

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Network Address Translation (NAT). A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Input validation error

EUVDB-ID: #VU64305

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30153

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Lightweight Directory Access Protocol (LDAP). A remote user can trick a victim to connect to a malicious LDAP server and execute arbitrary code on the target system.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Input validation error

EUVDB-ID: #VU64350

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30155

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Kernel. A remote attacker can trick a victim to open a specially crafted file and perform a denial of service (DoS) attack.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU64276

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30160

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Advanced Local Procedure Call, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

VASA Provider Standalone: before 9.2.4.21

eVASA Provider Virtual Appliance: before 9.2.4.11

Solutions Enabler Virtual Appliance: before 9.2.3.5

Solutions Enabler: before 9.2.3.5

Unisphere 360: before 9.2.3.8

Unisphere for PowerMax Virtual Appliance: before 9.2.3.20

Unisphere for PowerMax: before 9.2.3.20

http://www.dell.com/support/kbdoc/nl-nl/000203837/dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.