DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Dell PowerProtect Data Domain: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-01-30
Ein Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain ausnutzen, um erhöhte Rechte zu erlangen, einen Denial-of-Service-Zustand herbeizuführen und einen nicht näher spezifizierten Angriff durchzuführen.
01
beschreibt (185)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-53295US | high7.8 | — | ||
Dell PowerProtect DD versions prior to 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain an improper access control vulnerability. A local malicious user with low privileges could potentia… | ||||
| CVE-2024-53296US | medium4.9 | — | ||
Dell PowerProtect DD versions prior to 7.10.1.50 and 7.13.1.20 contain a Stack-based Buffer Overflow vulnerability in the RestAPI. A high privileged attacker with remote access cou… | ||||
| CVE-2024-51534US | high7.1 | — | ||
Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain a path traversal vulnerability. A local low privileged could potentially exploit this vulnerab… | ||||
| CVE-2024-4741US | — | — | ||
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause
memory to be accessed that was previously freed in some situations
Impact summary: A use after free can… | ||||
| CVE-2024-6232US | high7.5 | Exploit | ||
There is a MEDIUM severity vulnerability affecting CPython.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReD… | ||||
| CVE-2024-7592US | high7.5 | — | ||
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted chara… | ||||
| CVE-2024-7264US | medium6.5 | — | ||
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an
ASN.1 Generalized Time field. If given an syntactically incorrect field, the
parser might end up usin… | ||||
| CVE-2023-28074US | high7.1 | — | ||
Dell BSAFE Crypto-C Micro Edition, version 4.1.5, and Dell BSAFE Micro Edition Suite, versions 4.0 through 4.6.1 and version 5.0, contains an Out-of-bounds Read vulnerability. An u… | ||||
| CVE-2024-41110US | —OT erhöht | Exploit | ||
Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine, which could allow a… | ||||
| CVE-2024-1975US | — | — | ||
If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resol… | ||||
| CVE-2024-1737US | — | — | ||
Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being… | ||||
| CVE-2024-6655US | — | — | ||
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory. | ||||
| CVE-2024-6345US | — | — | ||
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to… | ||||
| CVE-2024-3651US | high7.5 | Exploit | ||
A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of cr… | ||||
| CVE-2024-39689US | high7.5OT erhöht | Exploit | ||
Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30… | ||||
| CVE-2024-33871US | — | — | ||
An issue was discovered in Artifex Ghostscript before 10.03.1. contrib/opvp/gdevopvp.c allows arbitrary code execution via a custom Driver library, exploitable via a crafted PostSc… | ||||
| CVE-2024-37371US | critical9.1 | — | ||
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. | ||||
| CVE-2024-37370US | high7.5OT erhöht | — | ||
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear trun… | ||||
| CVE-2024-5535US | — | Exploit | ||
Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an
empty supported client protocols buffer may cause a crash or memory contents to
be sent to the peer.… | ||||
| CVE-2024-37891US | medium6.5 | — | ||
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured… | ||||
20 von 185 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Amazon Linux Security Advisory ALAS-2025-2804 vom 2025-04-02external
- Ubuntu Security Notice USN-7429-1 vom 2025-04-09external
- Ubuntu Security Notice USN-7429-2 vom 2025-04-09external
- WID-SEC-W-2025-0225 - CSAF Versionself
- WID-SEC-2025-0225 - Portal Versionself
- Dell Security Update vom 2025-10-02external
- Dell Security Advisory DSA-2025-022 vom 2025-01-30external
- Security Update for Dell PowerProtect Data Domainexternal
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan