CVE-2019-3708

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while uploading an OVA file. A remote attacker can trick an admin user to potentially exploit this vulnerability to execute malicious HTML or JavaScript code in the context of the admin user.

Metrics

CVSS 3.0 9.6/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Dell EMC	Dell EMC IsilonSD Management Server	1.1.0

References

https://seclists.org/fulldisclosure/2019/Apr/16Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2019/Apr/16Mailing List, Third Party Advisory

Timeline

Published: Apr 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-37099.6IsilonSD Management Server 1.1.0 contains a cross-site scripting vulnerability while registering vCenter servers. A remote attacker can tric CVE-2019-37108.1Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumen CVE-2019-37117.2RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console CVE-2019-37128.8Dell WES Wyse Device Agent versions prior to 14.1.2.9 and Dell Wyse ThinLinux HAgent versions prior to 5.4.55 00.10 contain a buffer overflo CVE-2019-37155.5RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in CVE-2019-37167.8RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in pla CVE-2019-37176.8Select Dell Client Commercial and Consumer platforms contain an Improper Access Vulnerability. An unauthenticated attacker with physical acc CVE-2019-37188.8Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker CVE-2019-37198.0Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the CVE-2019-37204.9Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain a Directory Traversal Vulnerability. A remote authenticated CVE-2019-37217.5Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote CVE-2019-37227.5Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external entity (XXE) injectio