Summary
Ein Angreifer kann mehrere Schwachstellen in Dell PowerScale OneFS ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.
Product
PowerScale ist eine NAS-Plattform, die für die Verwaltung großer Datenmengen in unternehmenskritischen Umgebungen optimiert ist.
Vulnerabilities 18
-
Critical 9.8
Use After Free with SSL_free_buffers
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, cra…
-
Critical 9.0
NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function…
-
Critical 9.0
NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function…
-
High 7.5CVE-2022-43680 Public exploit
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…
-
High 7.5
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…
-
High 7.5CVE-2024-28757 Public exploit
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…
-
High 7.5
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that i…
-
Medium 6.9
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is n…
-
Medium 6.7
NVIDIA Bluefield and ConnectX contain a vulnerability in the management interface that could allow a malicious actor wi…
-
Medium 6.5CVE-2025-60876 Public exploit
BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/qu…
-
Medium 5.9
Excessive time spent checking invalid RSA public keys
Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been…
-
Medium 5.6
Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: …
-
Medium 5.5
libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
-
Medium 4.0
libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
-
Medium 4.0
libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
-
Low 2.9
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing…
-
Low 2.9
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
-
Low 2.9
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-mem…
Revision history
-
#2
Neue Updates von Dell aufgenommen
-
#1
Initiale Fassung
References
-
Dell Security Advisory dsa-2026-315 vom 2026-08-18
https://www.dell.com/support/kbdoc/de-de/000501312/dsa-2026-315-security-update-for-dell-powerscale-onefs-multiple-third-party-component-vulnerabilities
-
Dell Security Advisory DSA-2026-407 vom 2026-10-01
https://www.dell.com/support/kbdoc/de-de/000515304/dsa-2026-407-security-update-for-dell-powerscale-onefs-multiple-third-party-component-vulnerabilities