Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler

1) Link following

EUVDB-ID: #VU25235

Risk: Low

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2020-0683

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: Yes

The vulnerability allows a local user to elevate privileges on the system.

The vulnerability exists within the Windows Installer when MSI packages process symbolic links. A local user can bypass access restrictions to add or remove files and escalate privileges on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Out-of-bounds read

EUVDB-ID: #VU25164

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0676

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Cryptography Next Generation (CNG) service. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU25165

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0677

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Cryptography Next Generation (CNG) service. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25183

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0678

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Error Reporting manager handles hard links. A local user can create a malicious application, launch it on the system and overwrite a targeted file leading to an elevated status.

To exploit this vulnerability, an attacker would first have to log on to the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU25196

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0681

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of untrusted input within the Windows Remote Desktop Client when a user connects to a malicious server. A remote attacker can execute arbitrary code on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU25193

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0680

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Function Discovery Service when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Buffer overflow

EUVDB-ID: #VU25194

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0682

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Function Discovery Service when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Link following

EUVDB-ID: #VU25237

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0686

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

The vulnerability allows a local user to elevate privileges on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU25154

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0667

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Search Indexer when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds read

EUVDB-ID: #VU25248

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0698

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Telephony Service. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU25241

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0703

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Backup Service improperly handles file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Buffer overflow

EUVDB-ID: #VU25181

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0726

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Out-of-bounds read

EUVDB-ID: #VU25210

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0658

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Windows Common Log File System (CLFS) driver. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Buffer overflow

EUVDB-ID: #VU25170

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0691

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Windows kernel-mode driver. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Out-of-bounds read

EUVDB-ID: #VU25239

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0705

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when the Windows Network Driver Interface Specification (NDIS) improperly handles memory. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Buffer overflow

EUVDB-ID: #VU25234

Risk: Low

CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-0708

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when the Windows Imaging Library improperly handles memory. A local attacker can trick a victim to open a specially crafted file, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

17) Out-of-bounds read

EUVDB-ID: #VU25163

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0675

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Cryptography Next Generation (CNG) service. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Buffer overflow

EUVDB-ID: #VU25157

Risk: Low

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2020-0668

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Kernel when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

19) Buffer overflow

EUVDB-ID: #VU25173

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0719

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Out-of-bounds read

EUVDB-ID: #VU25918

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0880

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Windows GDI component. A local user can trick a victim to open a specially crafted document or visit an untrusted webpage, trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25957

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0806

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in Windows Error Reporting when handling and executing files. A local user can run a specially crafted application to execute arbitrary code on the system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25975

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-0814

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Installer handles certain filesystem operations. A local user can escalate privileges on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

23) Buffer overflow

EUVDB-ID: #VU25939

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0822

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Language Pack Installer improperly handles file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Out-of-bounds read

EUVDB-ID: #VU25969

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0853

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when the Windows Imaging Component fails to properly handle objects in memory. A remote attacker can trick a victim to visit a specially crafted website, trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Buffer overflow

EUVDB-ID: #VU25947

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0860

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows ActiveX Installer Service improperly handles memory. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Buffer overflow

EUVDB-ID: #VU25904

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0877

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Out-of-bounds read

EUVDB-ID: #VU25912

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0879

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing untrusted data in Windows Graphics Device Interface (GDI). A local user can create a specially crafted application, trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Buffer overflow

EUVDB-ID: #VU25926

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0881

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code on the system.

The vulnerability exists due to a boundary error in the Windows Graphics Device Interface (GDI). A local user can trick a victim to visit a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Buffer overflow

EUVDB-ID: #VU25153

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0666

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Search Indexer when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Buffer overflow

EUVDB-ID: #VU25927

Risk: Low

CVSSv4.0: 4.5 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-0883

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

The vulnerability allows a local user to execute arbitrary code on the system.

The vulnerability exists due to a boundary error in the Windows Graphics Device Interface (GDI). A local user can trick a victim to visit a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

31) Out-of-bounds read

EUVDB-ID: #VU25919

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0882

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Windows GDI component. A local user can trick a victim to open a specially crafted document or visit an untrusted webpage, trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Out-of-bounds read

EUVDB-ID: #VU25932

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0885

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Windows GDI component. A remote attacker can trick a victim to open a specially crafted document or visit an untrusted webpage. trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Buffer overflow

EUVDB-ID: #VU25906

Risk: Low

CVSSv4.0: 6.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-0887

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

34) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25229

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-0655

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a remote authenticated user to escalate privileges on the system.

The vulnerability exists due to the way Remote Desktop Services formerly known as Terminal Services handles clipboard redirection. A remote authenticated user with access to a system running Remote Desktop Services can abuse clipboard redirection and execute arbitrary code in the context of another user's session.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

35) Buffer overflow

EUVDB-ID: #VU25209

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0657

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Windows Common Log File System (CLFS) driver. A local usre can run a specially crafted application to trigger memory corruption and execute arbitrary code on the system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25152

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-0665

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists in Active Directory Forest trust due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest. A remote user can gain elevated privileges on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

37) Buffer overflow

EUVDB-ID: #VU25224

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0715

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Graphics Component improperly handles objects in memory. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Buffer overflow

EUVDB-ID: #VU25174

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0720

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Buffer overflow

EUVDB-ID: #VU25880

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0802

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Network Connections Service when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Buffer overflow

EUVDB-ID: #VU25930

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0824

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) Buffer overflow

EUVDB-ID: #VU26843

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0895

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the VBScript engine. A remote administrator can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Buffer overflow

EUVDB-ID: #VU26842

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0967

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the VBScript engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Buffer overflow

EUVDB-ID: #VU26841

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0966

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the VBScript engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Buffer overflow

EUVDB-ID: #VU26808

Risk: High

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2020-0968

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the scripting engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability is being actively exploited in the wild as of October 1, 2020.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

45) Buffer overflow

EUVDB-ID: #VU25900

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0768

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content within the the ChakraCore scripting engine in Microsoft browsers. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Buffer overflow

EUVDB-ID: #VU25931

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0847

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the VBScript engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Buffer overflow

EUVDB-ID: #VU25890

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0830

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content within the the ChakraCore scripting engine in Microsoft browsers. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Out-of-bounds read

EUVDB-ID: #VU25167

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0755

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Cryptography Next Generation (CNG) service. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Buffer overflow

EUVDB-ID: #VU25892

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0832

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the scripting engine in Internet Explorer. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Buffer overflow

EUVDB-ID: #VU25893

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0833

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the scripting engine in Internet Explorer. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Buffer overflow

EUVDB-ID: #VU25186

Risk: Medium

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-0673

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the scripting engine. A remote user can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

52) Buffer overflow

EUVDB-ID: #VU24384

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2020-0674

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the scripting engine. A remote attacker can create a specially crafted webpage, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

53) Input validation error

EUVDB-ID: #VU24270

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0606

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input when the software fails to check the source markup of a file. A remote attacker can trick a victim to open s specially crafted file and execute arbitrary code in the context of the current user.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Input validation error

EUVDB-ID: #VU24271

Risk: High

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2020-0646

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input in the Microsoft .NET Framework. A remote attacker can pass specific input to an application utilizing susceptible .Net methods and execute arbitrary code on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

55) Input validation error

EUVDB-ID: #VU24269

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0605

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input when the software fails to check the source markup of a file. A remote attacker can trick a victim to open s specially crafted file and execute arbitrary code in the context of the current user.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Out-of-bounds read

EUVDB-ID: #VU25168

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0756

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Cryptography Next Generation (CNG) service. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25218

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-0754

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Error Reporting (WER) handles and executes files. A local user can run a specially crafted application and gain elevated privileges on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

58) Buffer overflow

EUVDB-ID: #VU25175

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0721

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Use-after-free

EUVDB-ID: #VU25182

Risk: Low

CVSSv4.0: 6.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-0731

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory in win32kbase HMMarkObjectDestroy within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

60) Buffer overflow

EUVDB-ID: #VU25176

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0722

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Buffer overflow

EUVDB-ID: #VU25178

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0723

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Buffer overflow

EUVDB-ID: #VU25180

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0725

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Buffer overflow

EUVDB-ID: #VU25179

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0724

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Input validation error

EUVDB-ID: #VU25207

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0729

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input when processing .LNK files. A remote attacker can trick a victim to open a removable drive, or remote share, that contains a malicious .LNK file and execute arbitrary code on the target system. 

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Input validation error

EUVDB-ID: #VU25197

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0734

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insufficient validation of untrusted input within the Windows Remote Desktop Client when a user connects to a malicious server. A remote attacker can execute arbitrary code on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25208

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0730

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows handles symlinks. A local user can create a malicious application, launch it on the system and delete files and folders in an elevated context.

To exploit this vulnerability, an attacker would first have to log on to the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Out-of-bounds read

EUVDB-ID: #VU25162

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0736

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Windows kernel. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Buffer overflow

EUVDB-ID: #VU25156

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0752

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Search Indexer when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Buffer overflow

EUVDB-ID: #VU25155

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0735

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Search Indexer when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Buffer overflow

EUVDB-ID: #VU25236

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0738

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when Windows Media Foundation improperly handles objects in memory. A remote attacker can trick a victim to open a specially crafted document, or convinc a victim to visit a malicious webpage, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Buffer overflow

EUVDB-ID: #VU25242

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0737

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the tapisrv.dll when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Out-of-bounds read

EUVDB-ID: #VU25244

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0744

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when Windows Graphics Device Interface (GDI) improperly handles objects in memory. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Out-of-bounds read

EUVDB-ID: #VU25166

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0748

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Cryptography Next Generation (CNG) service. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Buffer overflow

EUVDB-ID: #VU25222

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0745

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Graphics Component improperly handles objects in memory. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25217

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-0753

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Error Reporting (WER) handles and executes files. A local user can run a specially crafted application and gain elevated privileges on the target system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

76) Buffer overflow

EUVDB-ID: #VU25881

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0803

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Network Connections Service when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Buffer overflow

EUVDB-ID: #VU25908

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0788

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Win32k component. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Buffer overflow

EUVDB-ID: #VU26802

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-1008

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Windows Jet Database Engine. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Buffer overflow

EUVDB-ID: #VU26798

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0992

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Windows Jet Database Engine. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Input validation error

EUVDB-ID: #VU26853

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0993

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the Windows DNS fails to properly handle queries. A remote authenticated attacker can send malicious DNS queries and perform a denial of service (DoS) attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Buffer overflow

EUVDB-ID: #VU26801

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0999

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Windows Jet Database Engine. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Buffer overflow

EUVDB-ID: #VU26840

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-1004

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Graphics Component improperly handles objects in memory. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Out-of-bounds read

EUVDB-ID: #VU26831

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-1005

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Microsoft Windows Graphics Component. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Out-of-bounds read

EUVDB-ID: #VU26816

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-1007

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Windows kernel. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU26884

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-1014

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

.The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Microsoft Windows Update Client does not properly handle privileges. A local user can run a specially crafted application and run processes in an elevated context 

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Buffer overflow

EUVDB-ID: #VU26797

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0988

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Windows Jet Database Engine. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Buffer overflow

EUVDB-ID: #VU26876

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2020-1015

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the User-Mode Power Service (UMPS) when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

88) Buffer overflow

EUVDB-ID: #VU26882

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-1094

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows Work Folder Service improperly handles file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Input validation error

EUVDB-ID: #VU26861

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0687

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input within the Windows font library when processing specially crafted embedded fonts. A remote attacker can trick the victim to open a specially crafted document or visit a website and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Buffer overflow

EUVDB-ID: #VU26803

Risk: Medium

CVSSv4.0: 4.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0889

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Windows Jet Database Engine. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Buffer overflow

EUVDB-ID: #VU26807

Risk: Critical

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2020-0938

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Windows Adobe Type Manager Library when parsing a specially-crafted multi-master font - Adobe Type 1 PostScript format. A remote attacker can create a specially crafted document, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, this vulnerability is being actively exploited in the wild.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

92) Out-of-bounds read

EUVDB-ID: #VU26790

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0946

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within Media Foundation. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Out-of-bounds read

EUVDB-ID: #VU26870

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0952

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Windows GDI component. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Out-of-bounds read

EUVDB-ID: #VU26834

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0987

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the processing of EMF images in gdi32full.dll Windows Graphics Component. A local user can use a specially EMR_SETDIBITSTODEVICE record in an EMF image to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Buffer overflow

EUVDB-ID: #VU26833

Risk: High

CVSSv4.0: 5.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0907

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within Microsoft Graphics Components. A remote authenticated attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Out-of-bounds read

EUVDB-ID: #VU26820

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0955

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Windows kernel when certain central processing units (CPU) speculatively access memory. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Improper input validation

EUVDB-ID: #VU27223

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2767

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the JSSE component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Improper input validation

EUVDB-ID: #VU27212

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-2803

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Java component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Improper input validation

EUVDB-ID: #VU27219

Risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-2805

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Libraries component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Buffer overflow

EUVDB-ID: #VU21942

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-18197

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the xsltCopyText() function in transform.c in libxslt. A remote attacker can create a specially crafted XML document, pass it to the affected application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Improper input validation

EUVDB-ID: #VU27220

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2816

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the JSSE component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Improper input validation

EUVDB-ID: #VU27221

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2781

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the JSSE component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Improper input validation

EUVDB-ID: #VU27222

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2830

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Concurrency component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Improper input validation

EUVDB-ID: #VU27224

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-2800

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Lightweight HTTP Server component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Out-of-bounds read

EUVDB-ID: #VU26818

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0821

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the Windows kernel. A local user can use a specially crafted application to trigger out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Improper input validation

EUVDB-ID: #VU27225

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2778

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the JSSE component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Improper input validation

EUVDB-ID: #VU27226

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2764

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Advanced Management Console component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Improper input validation

EUVDB-ID: #VU27227

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2754

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Scripting component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Improper input validation

EUVDB-ID: #VU27228

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2755

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Scripting component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Improper input validation

EUVDB-ID: #VU27229

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2773

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Security component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Improper input validation

EUVDB-ID: #VU27230

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2756

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Improper input validation

EUVDB-ID: #VU27231

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-2757

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Serialization component in Java SE Embedded. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Buffer overflow

EUVDB-ID: #VU26804

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-0953

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the Windows Jet Database Engine. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Buffer overflow

EUVDB-ID: #VU26811

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0957

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing objects in memory within the Windows kernel-mode driver. A local user can create a malicious application, launch it on the system and execute arbitrary code with SYSTEM privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25962

Risk: Low

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2020-0787

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Background Intelligent Transfer Service (BITS) handles symbolic links. A local user can create a malicious application, launch it on the system and overwrite a targeted file leading to an elevated status.

To exploit this vulnerability, an attacker would first have to log on to the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

116) Buffer overflow

EUVDB-ID: #VU25937

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0769

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows CSC Service improperly handles memory. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25977

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0843

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Installer handles certain filesystem operations. A local user can escalate privileges on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Buffer overflow

EUVDB-ID: #VU25954

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0844

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when Connected User Experiences and Telemetry Service improperly handles file operations. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Buffer overflow

EUVDB-ID: #VU25883

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0845

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Network Connections Service when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25924

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0849

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows handles hard links. A local user can create a malicious application, launch it on the system and overwrite a targeted file leading to an elevated status.

To exploit this vulnerability, an attacker would first have to log on to the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Out-of-bounds read

EUVDB-ID: #VU25884

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0871

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when handling objects in memory within Windows Network Connections Service. A local user can create a specially crafted application and gain access to memory contents of an elevated process.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) HTTP response splitting

EUVDB-ID: #VU25909

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-0645

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Exploit availability: No

The vulnerability allows a remote attacker to perform HTTP splitting attacks.

The vulnerability exists due to software does not corrector process HTTP request headers. A remote attacker can send specially crafted HTTP request and modify the response, sent by the web server.

Successful exploitation of the vulnerability may allow an attacker perform cache poisoning attack.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Buffer overflow

EUVDB-ID: #VU25948

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0770

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows ActiveX Installer Service improperly handles memory. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) Buffer overflow

EUVDB-ID: #VU25882

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0804

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Network Connections Service when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) Buffer overflow

EUVDB-ID: #VU25938

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0771

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows CSC Service improperly handles memory. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) Buffer overflow

EUVDB-ID: #VU25950

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0773

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error when the Windows ActiveX Installer Service improperly handles memory. A local user can use a specially crafted application to trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) Link following

EUVDB-ID: #VU25972

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0779

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure processing of symbolic links in MSI packages within the Windows Installer. A local user can create a specially crafted symbolic link and elevate privileges on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) Buffer overflow

EUVDB-ID: #VU25879

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0778

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privilege so the system.

The vulnerability exists due to a boundary error in the Windows Network Connections Service when handling objects in memory. A local user can create a specially crafted application, trigger memory corruption and execute arbitrary code on the target system with elevated privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25928

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0781

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Universal Plug and Play (UPnP) service handles objects in memory. A local user can create a malicious application, launch it on the system and run arbitrary code with elevated system privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25929

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0783

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Universal Plug and Play (UPnP) service handles objects in memory. A local user can create a malicious application, launch it on the system and run arbitrary code with elevated system privileges.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25960

Risk: Low

CVSSv4.0: 4.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0785

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows User Profile Service (ProfSvc) handles symlinks. A local user can create a malicious application, launch it on the system and delete files and folders in an elevated context.

To exploit this vulnerability, an attacker would first have to log on to the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*

https://www.dell.com/support/kbdoc/en-us/000153851/dsa-2020-130-dell-emc-unisphere-for-powermax-dell-emc-unisphere-for-powermax-virtual-appliance-dell-emc-solutions-enabler-dell-emc-solutions-enabler-virtual-appliance-and-dell-emc-powermax-embedded-management-update-for-multiple-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

132) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU25976

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-0842

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the way Windows Installer handles certain filesystem operations. A local user can escalate privileges on the system.

Install update from vendor's website.

Solutions Enabler Virtual Appliance: before 9.0.0.19

Solutions Enabler: before 9.0.0.19

Unisphere for PowerMax Virtual Appliance: before 9.0.2.18

Unisphere for PowerMax: before 9.0.2.18

• cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*
• cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*