Policy Manager For Secure Connect Gateway

CVE-2025-36592 Oct 30, 16:15 MEDIUM This Month

Cross-site scripting in Dell Secure Connect Gateway (SCG) Policy Manager versions 5.20, 5.22, 5.24, 5.26, and 5.28 allows unauthenticated remote attackers to inject script into the web interface; the injected code executes in the browser context of a legitimate user who loads a crafted page or clicks a crafted link (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, 5.4). No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); EPSS is 0.21% (11th percentile), consistent with a low real-world priority because the required user interaction blocks automated, mass exploitation. Practical impact is limited to the victim's browser session and the data reachable through it, with no server-side availability or confidentiality impact beyond low scope-limited effects.

CVE-2024-37131 Jun 13, 15:15 CRITICAL Act Now

SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-24907 Mar 01, 14:15 HIGH PATCH This Week

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. Rated high severity (CVSS 7.6), this vulnerability is low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-24905 Mar 01, 14:15 HIGH PATCH This Week

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. Rated high severity (CVSS 7.6), this vulnerability is low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-24904 Mar 01, 14:15 HIGH PATCH This Week

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. Rated high severity (CVSS 7.6), this vulnerability is low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-24903 Mar 01, 14:15 HIGH PATCH This Week

Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity.

CVE-2024-24906 Mar 01, 13:15 HIGH PATCH This Week

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. Rated high severity (CVSS 7.6), this vulnerability is low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2024-24900 Mar 01, 13:15 HIGH PATCH This Week

Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.

CVE-2023-39252 Sep 21, 06:15 MEDIUM PATCH This Month

Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.