CVE-2018-1239

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Dell EMC	Unity Operating Environment (OE)	versions prior to 4.3.0.1522077968

References

http://seclists.org/fulldisclosure/2018/May/15Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/104092Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2018/May/15Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/104092Third Party Advisory, VDB Entry

Timeline

Published: May 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-123909.8Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed e CVE-2018-123918.8During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Becaus CVE-2018-123929.8When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable c CVE-2018-123937.5A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 repres CVE-2018-123957.5By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This CVE-2018-123966.5A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for po CVE-2018-123977.1A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websit CVE-2018-123986.5By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security CVE-2018-123994.3When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registe CVE-2018-12408.0Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure c CVE-2018-124005.3In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows CVE-2018-124017.5Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This