Dell Wyse Management Suite vulnerabilities

CVE-2022-23155 [HIGH] CWE-434 CVE-2022-23155: Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerabil Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerability. A malicious user with admin privileges can exploit this vulnerability in order to execute arbitrary code on the system.

CVE-2021-36336 [CRITICAL] CWE-502 CVE-2021-36336: Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could al Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execute code on the affected system.

CVE-2021-36337 [HIGH] CWE-326 CVE-2021-36337: Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible to Man-In-The-Middle attacks thereby compromising Confidentiality and Integrity of data.

CVE-2021-21586 [MEDIUM] CWE-36 CVE-2021-21586: Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A r Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A remote authenticated malicious user could exploit this vulnerability in order to read arbitrary files on the system.

CVE-2021-21587 [LOW] CWE-200 CVE-2021-21587: Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability. A Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability. A local unauthenticated attacker could exploit this vulnerability in order to obtain the path of files and folders.

CVE-2021-21533 [MEDIUM] CWE-20 CVE-2021-21533: Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated Wyse Management Suite versions up to 3.2 contains a vulnerability wherein a malicious authenticated user can cause a denial of service in the job status retrieval page, also affecting other users that would have normally access to the same subset of job details

CVE-2020-29498 [MEDIUM] CWE-601 CVE-2020-29498: Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote un Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks tha

CVE-2020-29496 [MEDIUM] CWE-79 CVE-2020-29496: Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with high privileges could exploit this vulnerability to store malicious HTML or JavaScript code while creating the Enduser. When victim users access the submitted data through their browsers, the malicious code

CVE-2020-29497 [MEDIUM] CWE-79 CVE-2020-29497: Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious HTML or JavaScript code under the device tag. When victim users access the submitted data through their browsers, the malicious code gets ex

CVE-2019-3769 [MEDIUM] CWE-79 CVE-2019-3769: Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerabili Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious payload in the device heartbeat request. When victim users access the submitted data through their browsers, the malicious code gets execute

CVE-2019-3770 [MEDIUM] CWE-79 CVE-2019-3770: Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerabili Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability when unregistering a device. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious HTML or JavaScript code. When victim users access the submitted data through their browsers, the malicious code

CVE-2018-11063 [HIGH] CWE-428 CVE-2018-11063: Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Affe Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Affected software installs multiple services incorrectly by specifying the paths to the service executables without quotes. This could potentially allow a low-privileged local user to execute arbitrary executables with elevated privileges.