Powerstore
Monthly
Path traversal in Dell PowerStore's Service user account allows a locally authenticated low-privileged attacker to write to arbitrary system files across all PowerStore appliance models running firmware before 4.4.0.0-2692403. The flaw (CWE-35) sits in the Service user's file-handling logic, which fails to sanitize path components, enabling escape from the intended file scope to system-critical locations. No public exploit exists and SSVC rates exploitation as none, placing this firmly in a planned-patching rather than emergency-response tier despite the elevated CVSS integrity and availability scores.
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Path traversal in Dell PowerStore's Service user account allows a locally authenticated low-privileged attacker to write to arbitrary system files across all PowerStore appliance models running firmware before 4.4.0.0-2692403. The flaw (CWE-35) sits in the Service user's file-handling logic, which fails to sanitize path components, enabling escape from the intended file scope to system-critical locations. No public exploit exists and SSVC rates exploitation as none, placing this firmly in a planned-patching rather than emergency-response tier despite the elevated CVSS integrity and availability scores.
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.