← Vulnerability feed

Vulnerability record · CVE-2018-1246 · published 28 September 2018

CVE-2018-1246: Dell emc unity operating environment cross-site scripting vulnerability

Dell · Emc Unity Operating Environment

Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser.

6.1 CVSS 3.0 Medium EPSS 1.1% · top 35.1% CWE-79 · Cross-site scripting
6.1CVSS 3.0 base score, v2 4.3
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://seclists.org/fulldisclosure/2018/Sep/30 Mailing ListThird Party Advisory
https://seclists.org/fulldisclosure/2018/Sep/30 Mailing ListThird Party Advisory

Track CVE-2018-1246 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-36287Dell emc unity operating environment os command injection vulnerabilityDell VNX2 for file version 8.1.21.266 and earlier, contain an unauthenticated remote code execution vulnerability which may lead unauthenticated user…EPSS 2.6%9.8CVE-2021-36294Dell emc unity operating environment vulnerabilityDell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit …EPSS 1.6%9.8CVE-2018-1183Dell emc smis xml external entity (xxe) vulnerabilityIn Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, D…EPSS 2.0%9.1CVE-2021-36288Dell emc unity operating environment path traversal vulnerabilityDell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead unauthenticated users to read/write restrict…EPSS 1.0%7.8CVE-2021-36289Dell emc unity operating environment sensitive information in log file vulnerabilityDell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit t…EPSS 0.24%7.8CVE-2019-3741Dell emc unity operating environment vulnerabilityDell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s (including the ad…EPSS 0.34%7.8CVE-2018-11064Dell emc unity operating environment incorrect permission assignment vulnerabilityDell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A l…EPSS 0.39%7.5CVE-2020-5319Dell emc unity operating environment vulnerabilityDell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Server SSH …EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2018-1246), CISA KEV, FIRST EPSS (scores of 2026-09-30). This page is refreshed as NVD updates the record.