Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
55 results · page 1 of 2
Sep 15, 2026On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System PCVE-2026-73467 · Other software · Arista Networks · reported by psirt@arista.comMedium 6
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers
- Product
- EOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.90.00, contain an Exposure of Sensitive SCVE-2026-26948 · Other software · Dell · reported by security_alert@emc.comMedium 4.9
Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.90.00, contain an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.
- Product
- Integrated Dell Remote Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 18, 2026Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integrated Dell Remote AccCVE-2026-26945 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions prior to 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain a Process Control vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to code execution.
- Product
- Integrated Dell Remote Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 12, 2026An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory viaCVE-2025-70873 · Other software · Siemens · reported by MITREHigh 7.5
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
- Product
- RUGGEDCOM CROSSBOW Station Access Controller (SAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comsqlite.org
Jan 28, 2026Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated prCVE-2020-36987 · Other software · Gearboxcomputers · reported by VulnCheckHigh 8.5
Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path during system startup or reboot to inject and run malicious executables with LocalSystem permissions.
- Product
- Program Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comgearboxcomputers.com
Nov 6, 2025Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell CVE-2025-22397 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access Controller 10, 17G versions prior to 1.20.25.00, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
- Product
- Integrated Dell Remote Access Controller 9 14G Versions
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2024iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI.CVE-2024-25943 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.
- Product
- Integrated Dell Remote Access Controller 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2024The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belongingCVE-2024-3749 · WordPress plugins & themes · reported by WPScanMedium 6.5
The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user
- Product
- SP Project & Document Manager
- Affected
- up to 4.71
- What to do
- Affects up to 4.71. Update SP Project & Document Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 9, 2024A command injection vulnerability exists in local RACADM.CVE-2024-25951 · Other software · Dell · reported by security_alert@emc.comHigh 8
A command injection vulnerability exists in local RACADM. A malicious authenticated user could gain control of the underlying operating system.
- Product
- Integrated Dell Remote Access Controller 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2023An issue was discovered in Cassia Access Controller 2.1.1.2303271039.CVE-2023-35794 · Other software · Cassianetworks · reported by MITREHigh 8.8
An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. Specifically, there is no session cookie validation on the Access Controller; instead, there is only Basic Authentication to the SSH console.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.kscsc.onlinegithub.com
Sep 27, 2023An issue was discovered in Cassia Access Controller 2.1.1.2303271039.CVE-2023-35793 · Other software · Cassianetworks · reported by MITREHigh 8.8
An issue was discovered in Cassia Access Controller 2.1.1.2303271039. Establishing a web SSH session to gateways is vulnerable to Cross Site Request Forgery (CSRF) attacks.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.kscsc.onlinegithub.com
May 11, 2023Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows read-only users have tCVE-2023-31445 · Other software · Cassianetworks · reported by MITREMedium 5.3
Cassia Access controller before 2.1.1.2203171453, was discovered to have a unprivileged -information disclosure vulnerability that allows read-only users have the ability to enumerate all other users and discover e-mail addresses, phone numbers, and privileges of all other users.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.kscsc.onlinegithub.com
Jan 18, 2023 Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set.CVE-2022-34436 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update.
- Product
- Integrated Dell Remote Access Controller 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023 Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set.CVE-2022-34435 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update.
- Product
- Integrated Dell Remote Access Controller 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2022An attacker may be able to use minify route with a relative path to view any file on the Cassia Networks Access Controller prior to 2.0.1.CVE-2021-22685 · Other software · Cassia Networks · reported by ics-cert@hq.dhs.govMedium 6.2
An attacker may be able to use minify route with a relative path to view any file on the Cassia Networks Access Controller prior to 2.0.1.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcassianetworks.comcisa.gov
Jun 11, 2022A vulnerability was found in SICUNET Access Controller 0.32-05z.CVE-2017-20040 · Other software · SICUNET · reported by VulDBMedium 5.9
A vulnerability was found in SICUNET Access Controller 0.32-05z. It has been declared as problematic. This vulnerability affects unknown code of the component Password Storage. The manipulation leads to weak encryption. Attacking locally is a requirement.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2022A vulnerability was found in SICUNET Access Controller 0.32-05z.CVE-2017-20039 · Other software · SICUNET · reported by VulDBCritical 9.8
A vulnerability was found in SICUNET Access Controller 0.32-05z. It has been classified as very critical. This affects an unknown part. The manipulation leads to weak authentication. It is possible to initiate the attack remotely.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2022A vulnerability was found in SICUNET Access Controller 0.32-05z and classified as critical.CVE-2017-20038 · Other software · SICUNET · reported by VulDBMedium 6.3
A vulnerability was found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this issue is some unknown functionality of the file card_scan_decoder.php. The manipulation of the argument No/door leads to privilege escalation. The attack may be launched remotely.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2022A vulnerability has been found in SICUNET Access Controller 0.32-05z and classified as critical.CVE-2017-20037 · Other software · SICUNET · reported by VulDBMedium 6.3
A vulnerability has been found in SICUNET Access Controller 0.32-05z and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument c leads to privilege escalation. The attack can be launched remotely.
- Product
- Access Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability.CVE-2022-24422 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the VNC Console.
- Product
- Integrated Dell Remote Access Controller 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability.CVE-2022-24423 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to cause resource exhaustion in the webserver, resulting in a denial of service condition.
- Product
- Integrated Dell Remote Access Controller 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability.CVE-2021-36348 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to iDRAC.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability.CVE-2021-36347 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attacker with high privileges could potentially exploit this vulnerability to control process execution and gain access to the iDRAC operating system.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability.CVE-2021-36346 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to deny access to the iDRAC webserver.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm.CVE-2021-36301 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control process execution and gain access to the underlying operating system.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.emc.comsupport.emc.com
Nov 23, 2021iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability.CVE-2021-36300 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a specially crafted malicious request to crash the webserver or cause information disclosure.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.emc.comsupport.emc.com
Nov 23, 2021Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability.CVE-2021-36299 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.emc.comsupport.emc.com
Aug 3, 2021Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability.CVE-2021-21581 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL cCVE-2021-21580 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL can inject text to present a customized message on the application that can phish users into believing that the message is legitimate.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.CVE-2021-21579 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.CVE-2021-21578 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability.CVE-2021-21577 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability.CVE-2021-21576 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2021Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability.CVE-2021-21538 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the virtual console.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability.CVE-2021-21544 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities.CVE-2021-21543 · Other software · Dell · reported by security_alert@emc.comMedium 4.8
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities.CVE-2021-21542 · Other software · Dell · reported by security_alert@emc.comMedium 4.8
Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability.CVE-2021-21541 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability.CVE-2021-21540 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to overwrite configuration information by injecting arbitrarily large payload.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability.CVE-2021-21539 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2021Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability.CVE-2021-21510 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary ‘Host’ header values to poison a web-cache or trigger redirections.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application.CVE-2020-26198 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2020Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability.CVE-2020-5366 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2020Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability.CVE-2020-5344 · Other software · Dell · reported by security_alert@emc.comHigh 7
Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2019Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnCVE-2019-3764 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated malicious iDRAC user with low privileges may potentially exploit this vulnerability to obtain sensitive information such as password hashes.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2017Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.CVE-2015-7275 · Other software · Dell · reported by cret@cert.orgMedium 6.1
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.85 and 7/8 before 2.30.30.30 has XSS.
- Product
- Integrated Remote Access Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.community.dell.comsecurityfocus.com
Apr 9, 2017Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands.CVE-2015-7274 · Other software · Dell · reported by cret@cert.orgHigh 8.8
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 allows remote attackers to execute arbitrary administrative HTTP commands.
- Product
- Integrated Remote Access Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.community.dell.comsecurityfocus.com
Apr 9, 2017Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.CVE-2015-7273 · Other software · Dell · reported by cret@cert.orgCritical 9.8
Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has XXE.
- Product
- Integrated Remote Access Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.community.dell.comen.community.dell.com
Apr 9, 2017Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possCVE-2015-7272 · Other software · Dell · reported by cret@cert.orgCritical 9.8
Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input.
- Product
- Integrated Remote Access Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.community.dell.comsecurityfocus.com
Apr 9, 2017Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo.CVE-2015-7271 · Other software · Dell · reported by cret@cert.orgCritical 9.8
Dell Integrated Remote Access Controller (iDRAC) 7/8 before 2.21.21.21 has a format string issue in racadm getsystinfo.
- Product
- Integrated Remote Access Controller Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.community.dell.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.