Filtered by vendor Dell Subscriptions
Filtered by product Emc Appsync Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-22464 1 Dell 1 Emc Appsync 2024-11-21 6.2 Medium
Dell EMC AppSync, versions from 4.2.0.0 to 4.6.0.0 including all Service Pack releases, contain an exposure of sensitive information vulnerability in AppSync server logs. A high privileged remote attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable system with privileges of the compromised account.
CVE-2022-24424 1 Dell 1 Emc Appsync 2024-11-21 7.5 High
Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
CVE-2022-22553 1 Dell 1 Emc Appsync 2024-11-21 8.1 High
Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability that can be exploited from UI and CLI. An adjacent unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are used by users.
CVE-2022-22552 1 Dell 1 Emc Appsync 2024-11-21 6.9 Medium
Dell EMC AppSync versions 3.9 to 4.3 contain a clickjacking vulnerability in AppSync. A remote unauthenticated attacker could potentially exploit this vulnerability to trick the victim into executing state changing operations.
CVE-2022-22551 1 Dell 1 Emc Appsync 2024-11-21 8.3 High
DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session.
CVE-2024-39586 1 Dell 1 Emc Appsync 2024-10-17 2.9 Low
Dell AppSync Server, version 4.3 through 4.6, contains an XML External Entity Injection vulnerability. An adjacent high privileged attacker could potentially exploit this vulnerability, leading to information disclosure.