CVE-2020-35167

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Dell	Dell BSAFE Crypto-C Micro Edition	>= unspecified, < 4.1.5 or 4.1.4.1

References

https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilitiesVendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://www.dell.com/support/kbdoc/en-us/000181115/dsa-2020-286-dell-bsafe-crypto-c-micro-edition-4-1-5-and-dell-bsafe-micro-edition-suite-4-6-multiple-security-vulnerabilitiesVendor Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Timeline

Published: Jul 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-351689.8Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Tim CVE-2020-351699.8Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Improper Inp CVE-2020-35178.6A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated attack CVE-2020-351705.4Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax CVE-2020-351739.8The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.CVE-2020-351755.3Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API.CVE-2020-351765.3In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was inten CVE-2020-351775.3HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.CVE-2020-35185.4A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) Software could allow an authenticated, rem CVE-2020-351849.8The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer docker container deploy CVE-2020-351859.8The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost doc CVE-2020-351869.8The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container