Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
73 results · page 1 of 2
Oct 28, 2026Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0,CVE-2026-81472 · Other software · Dell · reported by security_alert@emc.comMedium 4.2
Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versions prior to 6.1.1.0, contains an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- iDRAC Service Module for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2026Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper NeCVE-2026-23855 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command injection.
- Product
- iDRAC9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dCVE-2026-85506 · Other software · FreeIPMI · reported by MITRECritical 9.8
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).
- Product
- FreeIPMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability.CVE-2026-79940 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to gaining access to unauthorized data.
- Product
- iDRAC9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2026Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability.CVE-2026-70412 · Other software · Dell · reported by security_alert@emc.comLow 3.5
Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- iDRAC9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability.CVE-2026-28262 · Other software · Dell · reported by security_alert@emc.comMedium 6
Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
- Product
- iDRAC Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2026An issue was discovered in idrac in OpenStack Ironic before 35.0.1.CVE-2026-42997 · Other software · OpenStack · reported by MITREHigh 7.7
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides access to all OpenStack services Ironic is authorized for); or basic credentials configured for molds storage. The fixed versions are 26.1.6, 29.0.5, 32.0.1, and 35.0.1.
- Product
- Ironic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.openstack.orgopenwall.com
Apr 29, 2026Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability.CVE-2026-35155 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that could allow an authenticated low‑privileged attacker to gain elevated access.
- Product
- iDRAC10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4.1.1, contain an ImpCVE-2026-23856 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell iDRAC Service Module (iSM) for Windows, versions prior to 6.0.3.1, and Dell iDRAC Service Module (iSM) for Linux, versions prior to 5.4.1.1, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- iDRAC Service Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability.CVE-2025-26482 · Other software · Dell · reported by security_alert@emc.comMedium 4.9
Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.
- Product
- PowerEdge R770
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability.CVE-2025-38743 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges.
- Product
- iDRAC Service Module (iSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability.CVE-2025-38742 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
- Product
- iDRAC Service Module (iSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2025Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability.CVE-2025-27689 · Other software · Dell · reported by security_alert@emc.comHigh 7.8
Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
- Product
- iDRAC Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability.CVE-2024-38490 · Other software · Dell · reported by security_alert@emc.comMedium 5.8
Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute arbitrary code potentially resulting in a denial of service event.
- Product
- iDRAC Service Module (iSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability.CVE-2024-38489 · Other software · Dell · reported by security_alert@emc.comLow 3.1
Dell iDRAC Service Module version 5.3.0.0 and prior contains Out of bound write Vulnerability. A privileged local attacker could execute arbitrary code potentially resulting in a denial of service (partial) event.
- Product
- iDRAC Service Module (iSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Read Vulnerability.CVE-2024-38481 · Other software · Dell · reported by security_alert@emc.comMedium 4.8
Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Read Vulnerability. A privileged local attacker could execute arbitrary code potentially resulting in a denial of service event.
- Product
- iDRAC Service Module (iSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability.CVE-2024-25948 · Other software · Dell · reported by security_alert@emc.comMedium 4.8
Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute arbitrary code potentially resulting in a denial of service event.
- Product
- iDRAC Service Module (iSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 1, 2024Dell iDRAC Service Module version 5.3.0.0 and prior, contain an Out of bound Read Vulnerability.CVE-2024-25947 · Other software · Dell · reported by security_alert@emc.comMedium 4.8
Dell iDRAC Service Module version 5.3.0.0 and prior, contain an Out of bound Read Vulnerability. A privileged local attacker could execute arbitrary code potentially resulting in a denial of service event.
- Product
- iDRAC Service Module (iSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2024iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI.CVE-2024-25943 · Other software · Dell · reported by security_alert@emc.comHigh 7.6
iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a session hijacking vulnerability in IPMI. A remote attacker could potentially exploit this vulnerability, leading to arbitrary code execution on the vulnerable application.
- Product
- Integrated Dell Remote Access Controller 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2024Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictaCVE-2024-3411 · Other software · Dell · reported by cret@cert.orgCritical 9.1
Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device.
- Product
- iDRAC8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2024 Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability.CVE-2024-22428 · Other software · Dell · reported by security_alert@emc.comHigh 7
Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability. It may allow a local unprivileged user to escalate privileges and execute arbitrary code on the affected system. Dell recommends customers upgrade at the earliest opportunity.
- Product
- iDRAC Service Module (iSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023 Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set.CVE-2022-34436 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update.
- Product
- Integrated Dell Remote Access Controller 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 18, 2023 Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set.CVE-2022-34435 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remote high privileged attacker could exploit this vulnerability to bypass the firmware lock-down configuration and perform a firmware update.
- Product
- Integrated Dell Remote Access Controller 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability.CVE-2022-24422 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the VNC Console.
- Product
- Integrated Dell Remote Access Controller 9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability.CVE-2022-24423 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to cause resource exhaustion in the webserver, resulting in a denial of service condition.
- Product
- Integrated Dell Remote Access Controller 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability.CVE-2021-36348 · Other software · Dell · reported by security_alert@emc.comHigh 8.1
iDRAC9 versions prior to 5.00.20.00 contain an input injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to iDRAC.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability.CVE-2021-36347 · Other software · Dell · reported by security_alert@emc.comHigh 7.2
iDRAC9 versions prior to 5.00.20.00 and iDRAC8 versions prior to 2.82.82.82 contain a stack-based buffer overflow vulnerability. An authenticated remote attacker with high privileges could potentially exploit this vulnerability to control process execution and gain access to the iDRAC operating system.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 25, 2022Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability.CVE-2021-36346 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell iDRAC 8 prior to version 2.82.82.82 contain a denial of service vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to deny access to the iDRAC webserver.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 23, 2021Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm.CVE-2021-36301 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control process execution and gain access to the underlying operating system.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.emc.comsupport.emc.com
Nov 23, 2021iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability.CVE-2021-36300 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a specially crafted malicious request to crash the webserver or cause information disclosure.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.emc.comsupport.emc.com
Nov 23, 2021Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability.CVE-2021-36299 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.emc.comsupport.emc.com
Aug 3, 2021Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability.CVE-2021-21581 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL cCVE-2021-21580 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, where a malicious URL can inject text to present a customized message on the application that can phish users into believing that the message is legitimate.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.CVE-2021-21579 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.CVE-2021-21578 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability.CVE-2021-21577 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 3, 2021Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability.CVE-2021-21576 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2021Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability.CVE-2021-21538 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the virtual console.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2021Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account.CVE-2021-21505 · Other software · Dell · reported by security_alert@emc.comHigh 8
Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. A remote unauthenticated attacker, with the knowledge of the default credentials, could potentially exploit this to log in to the system to gain root privileges.
- Product
- Dell EMC Integrated System for Microsoft Azure Stack Hub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability.CVE-2021-21544 · Other software · Dell · reported by security_alert@emc.comLow 2.7
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities.CVE-2021-21543 · Other software · Dell · reported by security_alert@emc.comMedium 4.8
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities.CVE-2021-21542 · Other software · Dell · reported by security_alert@emc.comMedium 4.8
Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges could potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability.CVE-2021-21541 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability.CVE-2021-21540 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to overwrite configuration information by injecting arbitrarily large payload.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2021Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability.CVE-2021-21539 · Other software · Dell · reported by security_alert@emc.comMedium 5.9
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker could potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 8, 2021Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability.CVE-2021-21510 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by injecting arbitrary ‘Host’ header values to poison a web-cache or trigger redirections.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2020Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application.CVE-2020-26198 · Other software · Dell · reported by security_alert@emc.comMedium 6.1
Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to following a specially crafted link.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2020Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability.CVE-2020-5366 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2020Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability.CVE-2020-5344 · Other software · Dell · reported by security_alert@emc.comHigh 7
Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2019Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnCVE-2019-3764 · Other software · Dell · reported by security_alert@emc.comMedium 4.3
Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated malicious iDRAC user with low privileges may potentially exploit this vulnerability to obtain sensitive information such as password hashes.
- Product
- Integrated Dell Remote Access Controller (iDRAC)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.