Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler

1) Security restrictions bypass

EUVDB-ID: #VU53909

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-31199

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Microsoft Enhanced Cryptographic Provider. A local user can bypass implemented security restrictions and read or modify otherwise restricted information.

Note, the vulnerability is being actively exploited in the wild and related to a zero-day vulnerability in Adobe Reader #VU53125 (CVE-2021-28550) patched on May 11.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Buffer overflow

EUVDB-ID: #VU53880

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31959

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the Scripting Engine. A remote attacker can trick a victim to open a specially crafted file or visit a malicious website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53882

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31958

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows NTLM. A remote attacker can trick a victim to visit a specially crafted server share or website, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53891

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-31956

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists within the NTFS subsystem in Microsoft Windows. A local user can run a specially crafted program to execute arbitrary code with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

5) Heap-based buffer overflow

EUVDB-ID: #VU53883

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31954

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53884

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31953

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Filter Manager, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Security restrictions bypass

EUVDB-ID: #VU53910

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-31201

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions in Microsoft Enhanced Cryptographic Provider. A local user can bypass implemented security restrictions and read or modify otherwise restricted information.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

8) Code Injection

EUVDB-ID: #VU53095

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31194

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in OLE Automation. A remote authenticated attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Security features bypass

EUVDB-ID: #VU53920

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31968

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to security feature bypass issue in Windows Remote Desktop Services. A remote attacker can cause a denial of service condition on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53105

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31193

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows SSDP Service, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53093

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31188

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Graphics Component, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds read

EUVDB-ID: #VU53109

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31186

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in Windows Remote Desktop Protocol (RDP). A remote attacker can trick a victim to connect to a malicious RDP server, trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds read

EUVDB-ID: #VU53111

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-31184

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: Yes

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in Microsoft Windows Infrared Data Association (IrDA). A local user can trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

14) Input validation error

EUVDB-ID: #VU54699

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31183

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Windows TCP/IP Driver. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Spoofing attack

EUVDB-ID: #VU53118

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31182

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in Microsoft Bluetooth Driver. A remote attacker on the local network can spoof page content.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Security features bypass

EUVDB-ID: #VU53918

Risk: High

CVSSv3.1: 8.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31962

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Kerberos AppContainer. A remote attacker can bypass Kerberos authentication.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Security restrictins bypass

EUVDB-ID: #VU53914

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31971

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to Windows HTML Platform does not properly impose security restrictions. A remote attacker can create a specially crafted web page, trick the victim into opening it and bypass implemented security restrictions.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Information disclosure

EUVDB-ID: #VU52169

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28446

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Portmapping. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Spoofing attack

EUVDB-ID: #VU54750

Risk: Low

CVSSv3.1: 5.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33765

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

The vulnerability allows a local attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in the Windows Installer. A local attacker can spoof page content.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Security features bypass

EUVDB-ID: #VU54831

Risk: High

CVSSv3.1: 7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34446

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Windows HTML Platforms. A remote attacker can gain elevated privileges on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Code Injection

EUVDB-ID: #VU54739

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34441

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Microsoft Windows Media Foundation. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Information disclosure

EUVDB-ID: #VU54734

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34440

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in GDI+. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Input validation error

EUVDB-ID: #VU54812

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33788

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Windows LSA. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Information disclosure

EUVDB-ID: #VU54768

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33783

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows SMB. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Spoofing attack

EUVDB-ID: #VU54767

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33782

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

The vulnerability allows a local attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in the Windows Authenticode. A local attacker can spoof page content.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Security features bypass

EUVDB-ID: #VU54830

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33757

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Windows Security Account Manager Remote Protocol. A remote attacker can gain access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53903

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31973

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows GPSVC, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Code Injection

EUVDB-ID: #VU54796

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33756

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows DNS Snap-in. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Code Injection

EUVDB-ID: #VU54795

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33752

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows DNS Snap-in. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Code Injection

EUVDB-ID: #VU54794

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33750

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows DNS Snap-in. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Code Injection

EUVDB-ID: #VU54793

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33749

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows DNS Snap-in. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Buffer overflow

EUVDB-ID: #VU53897

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-33742

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content within Windows MSHTML Platform. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

33) Buffer overflow

EUVDB-ID: #VU54723

Risk: High

CVSSv3.1: 8.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-31979

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Windows kernel. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code on the system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

34) Code Injection

EUVDB-ID: #VU53117

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28455

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Microsoft Jet Red Database Engine and Access Connectivity Engine. A remote authenticated attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Code Injection

EUVDB-ID: #VU52168

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28445

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Windows Network File System. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Buffer overflow

EUVDB-ID: #VU54721

Risk: Critical

CVSSv3.1: 8.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-34448

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content in Microsoft scripting engine. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

37) Code Injection

EUVDB-ID: #VU52095

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28335

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Code Injection

EUVDB-ID: #VU52089

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28341

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Code Injection

EUVDB-ID: #VU52090

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28340

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Code Injection

EUVDB-ID: #VU52091

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28339

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Code Injection

EUVDB-ID: #VU52092

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28338

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Code Injection

EUVDB-ID: #VU52093

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28337

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Code Injection

EUVDB-ID: #VU52094

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28336

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Code Injection

EUVDB-ID: #VU52096

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28334

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Code Injection

EUVDB-ID: #VU52087

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28343

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Code Injection

EUVDB-ID: #VU52085

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28333

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Code Injection

EUVDB-ID: #VU52097

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28332

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Code Injection

EUVDB-ID: #VU52098

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28331

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Code Injection

EUVDB-ID: #VU52099

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28330

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Code Injection

EUVDB-ID: #VU52100

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28329

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Information disclosure

EUVDB-ID: #VU52133

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28328

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows DNS. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Code Injection

EUVDB-ID: #VU52088

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28342

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Code Injection

EUVDB-ID: #VU52086

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28344

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Input validation error

EUVDB-ID: #VU52125

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28443

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Windows Console Driver. A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Code Injection

EUVDB-ID: #VU52078

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28356

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU52102

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28440

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Installer, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Input validation error

EUVDB-ID: #VU52117

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28439

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Windows TCP/IP Driver. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Information disclosure

EUVDB-ID: #VU52103

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28437

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows Installer. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Code Injection

EUVDB-ID: #VU52076

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28434

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Code Injection

EUVDB-ID: #VU52077

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28358

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Code Injection

EUVDB-ID: #VU52075

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28357

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Code Injection

EUVDB-ID: #VU52079

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28355

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Code Injection

EUVDB-ID: #VU52084

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28345

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Code Injection

EUVDB-ID: #VU52080

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28354

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Code Injection

EUVDB-ID: #VU52081

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28353

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Code Injection

EUVDB-ID: #VU52082

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28352

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Code Injection

EUVDB-ID: #VU52106

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28350

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows GDI+. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Code Injection

EUVDB-ID: #VU52107

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28349

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows GDI+. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Code Injection

EUVDB-ID: #VU52108

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28348

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows GDI+. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Code Injection

EUVDB-ID: #VU52083

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28346

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Code Injection

EUVDB-ID: #VU54802

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34447

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows MSHTML Platform. A remote attacker can trick a victim to visit a specially crafted server share or website and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54759

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34456

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Remote Access Connection Manager, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Information disclosure

EUVDB-ID: #VU52132

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28323

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows DNS. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Information disclosure

EUVDB-ID: #VU54763

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33763

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows Remote Access Connection Manager. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Input validation error

EUVDB-ID: #VU54770

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33785

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Windows AF_UNIX Socket Provider. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54769

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33784

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Cloud Files Mini Filter Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Security features bypass

EUVDB-ID: #VU54835

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33781

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Active Directory. A remote authenticated attacker can gain elevated privileges on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54820

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33774

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Event Tracing, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54762

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33773

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Remote Access Connection Manager, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Buffer overflow

EUVDB-ID: #VU54720

Risk: High

CVSSv3.1: 8.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-33771

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code on the system with elevated privileges.

Note, the vulnerability is being actively exploited in the wild.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

81) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54764

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33761

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Remote Access Connection Manager, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54761

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34445

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Remote Access Connection Manager, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54822

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33759

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Desktop Bridge, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54778

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-33751

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Storage Spaces Controller, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

85) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54726

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33743

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Projected File System, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Code Injection

EUVDB-ID: #VU54724

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33740

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows Media. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Information disclosure

EUVDB-ID: #VU53899

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31976

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Server for NFS. A remote attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Information disclosure

EUVDB-ID: #VU53900

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31975

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Server for NFS. A remote attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Code Injection

EUVDB-ID: #VU54771

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34438

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows Font Driver Host. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54800

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34449

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Win32k, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Information disclosure

EUVDB-ID: #VU53904

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31972

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Event Tracing for Windows. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Information disclosure

EUVDB-ID: #VU54799

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34491

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Win32k. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54782

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34512

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Storage Spaces Controller, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54777

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34510

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Storage Spaces Controller, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Information disclosure

EUVDB-ID: #VU54780

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34509

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Storage Spaces Controller. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Code Injection

EUVDB-ID: #VU54786

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34508

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows Kernel. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Code Injection

EUVDB-ID: #VU54737

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34503

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Microsoft Windows Media Foundation. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54818

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34493

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local administrator to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Partition Management Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Input validation error

EUVDB-ID: #VU54700

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34490

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the Windows TCP/IP Driver. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Information disclosure

EUVDB-ID: #VU54760

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34454

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows Remote Access Connection Manager. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Code Injection

EUVDB-ID: #VU54735

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34489

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in DirectWrite. A remote attacker can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54736

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34488

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Console Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Security features bypass

EUVDB-ID: #VU54837

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34466

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a local attacker to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Windows Hello. An attacker with physical access can gain elevated privileges on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54825

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34462

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows AppX Deployment Extensions, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54781

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34460

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Storage Spaces Controller, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54765

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34459

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows AppContainer, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54732

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34455

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows File History Service, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Input validation error

EUVDB-ID: #VU53901

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31974

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Server for NFS. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Security features bypass

EUVDB-ID: #VU53919

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31970

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack..

The vulnerability exists due to security feature bypass issue in Windows TCP/IP Driver. A local user can cause a denial of service condition on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Information disclosure

EUVDB-ID: #VU54758

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34457

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows Remote Access Connection Manager. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Code Injection

EUVDB-ID: #VU54801

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34497

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows MSHTML Platform. A remote attacker can trick a victim to visit a specially crafted server share or website and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54788

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34514

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Kernel, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54749

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34511

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Installer, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Information disclosure

EUVDB-ID: #VU54774

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34507

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows Remote Assistance. A remote attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Code Injection

EUVDB-ID: #VU54733

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34504

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows Address Book. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Information disclosure

EUVDB-ID: #VU54789

Risk: Medium

CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34500

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows Kernel Hyper-V host server. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54757

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34498

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows GDI, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Information disclosure

EUVDB-ID: #VU54756

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34496

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows GDI. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Code Injection

EUVDB-ID: #VU53886

Risk: Critical

CVSSv3.1: 9.5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-34527

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the RpcAddPrinterDriverEx() function. A remote user can send a specially crafted request to the Windows Print Spooler and execute arbitrary code with SYSTEM privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being considered a zero-day and dubbed PrintNightmare. This is a different vulnerability than #VU54508 (CVE-2021-1675).

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

120) Spoofing attack

EUVDB-ID: #VU54819

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34492

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in Windows Certificate. A remote attacker can spoof page content.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU55695

Risk: Low

CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-34484

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows User Profile Service, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

122) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU55699

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34483

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Buffer overflow

EUVDB-ID: #VU54917

Risk: Medium

CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-34481

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Print Spooler service improperly performs privileged file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system with SYSTEM privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

124) Buffer overflow

EUVDB-ID: #VU55726

Risk: Medium

CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-34480

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to incorrect JIT optimization in jscript9.dll in the Scripting Engine. A remote attacker can trick a victim to open a specially crafted file or visit a malicious website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

125) Input validation error

EUVDB-ID: #VU54827

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34476

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Bowser.sys. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) Untrusted Pointer Dereference

EUVDB-ID: #VU54798

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34516

CWE-ID: CWE-822 - Untrusted Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to untrusted pointer dereference in DrvTransparentBltInternal() within the Microsoft Windows Canonical Display Driver cdd.dll. A local user can run a specially crafted program to execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) Code Injection

EUVDB-ID: #VU55703

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34533

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows Graphics Component Font Parsing. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53905

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31969

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Cloud Files Mini Filter Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53087

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31187

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows WalletService, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU54722

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31961

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows InstallService. A local user can delete targeted files on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Improper Privilege Management

EUVDB-ID: #VU53890

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C]

CVE-ID: CVE-2021-31955

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: Yes

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper privilege management. A local unprivileged user can read contents of Kernel memory from a user mode process.

Note, the vulnerability is being actively exploited in the wild.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

132) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53885

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31952

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Kernel-Mode Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

133) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53913

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31951

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Kernel, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

134) Out-of-bounds read

EUVDB-ID: #VU53107

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31191

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in Windows Projected File System FS Filter Driver. A local user can trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

135) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53108

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31190

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Container Isolation FS Filter Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

136) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53094

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31170

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Graphics Component, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

137) Code Injection

EUVDB-ID: #VU55714

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34535

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Remote Desktop Client and Hyper-V Viewer. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

138) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU53090

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31167

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Container Manager Service, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

139) Information disclosure

EUVDB-ID: #VU53115

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28479

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows CSC Service. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

140) Code Injection

EUVDB-ID: #VU55698

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-36947

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows Print Spooler. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

141) Code Injection

EUVDB-ID: #VU55721

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-36937

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows Media MPEG-4 Video Decoder. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

142) Code Injection

EUVDB-ID: #VU55700

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-36936

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Windows Print Spooler. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

143) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU55712

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-36927

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Digital TV Tuner device registration application, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

144) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU55731

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-34537

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows Bluetooth Driver, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

145) Code Injection

EUVDB-ID: #VU52101

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28327

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Remote Procedure Call Runtime. A remote authenticated attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

146) Information disclosure

EUVDB-ID: #VU52109

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28318

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows GDI+. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

147) Information disclosure

EUVDB-ID: #VU48267

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17000

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by Remote Desktop Protocol Client. A remote user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

148) Information disclosure

EUVDB-ID: #VU48268

Risk: Low

CVSSv3.1: 5.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17036

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the Windows Function Discovery SSDP Provider. A local attacker can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

149) Information disclosure

EUVDB-ID: #VU48306

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17029

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Canonical Display Driver. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

150) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU48280

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17014

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

151) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU48297

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17011

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Port Class Library, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

152) Information disclosure

EUVDB-ID: #VU48337

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17004

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in Windows Graphics Component. A local user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

153) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU48281

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17001

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Print Spooler, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

154) Information disclosure

EUVDB-ID: #VU48266

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-16997

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the Remote Desktop Protocol server. A remote authenticated user can gain unauthorized access to sensitive information on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

155) Code Injection

EUVDB-ID: #VU48278

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17042

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Windows Print Spooler. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

156) Buffer overflow

EUVDB-ID: #VU47541

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-16976

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Backup Service improperly handles file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

157) Buffer overflow

EUVDB-ID: #VU47537

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-16975

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Backup Service improperly handles file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

158) Buffer overflow

EUVDB-ID: #VU47538

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-16974

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Backup Service improperly handles file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

159) Buffer overflow

EUVDB-ID: #VU47539

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-16973

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Backup Service improperly handles file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

160) Buffer overflow

EUVDB-ID: #VU47540

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-16972

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Backup Service improperly handles file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

161) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU48830

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-16964

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Windows Backup Engine, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

162) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU48286

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17038

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in Win32k, which leads to security restrictions bypass and privilege escalation.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.2.2.0

Solutions Enabler: before 9.2.2.0

Unisphere for PowerMax Virtual Appliance: before 9.2.2.2

Unisphere for PowerMax: before 9.2.2.2

http://www.dell.com/support/kbdoc/en-us/000191079/draft

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

163) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU48257

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17043

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No