Amazon Linux AMI : ImageMagick (ALAS-2023-1781)

The version of ImageMagick installed on the remote host is prior to 6.9.10.97-1.26. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1781 advisory. stack overflow when parsing malicious tiff image CVE-2023-3195 The upstream bug report describes this issue as...

Amazon Linux AMI : kernel (ALAS-2023-1783)

The version of kernel installed on the remote host is prior to 4.14.320-168.534. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1783 advisory. A use-after-free flaw was found in the Netfilter subsystem of the Linux kernel when processing named and anonymous...

Amazon Linux AMI : python-imaging (ALAS-2023-1787)

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1787 advisory. Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the crafted image file approach, related to an Insecure Sign Extension issue affecting the ImagingNew in Storage.c...

Amazon Linux AMI : wireshark (ALAS-2023-1785)

The version of wireshark installed on the remote host is prior to 1.8.10-25.24. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1785 advisory. Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in a...

Amazon Linux AMI : libX11 (ALAS-2023-1782)

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1782 advisory. A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that...

Amazon Linux AMI : tomcat8 (ALAS-2023-1779)

The version of tomcat8 installed on the remote host is prior to 8.5.89-1.93. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1779 advisory. The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.8...

Amazon Linux AMI : c-ares (ALAS-2023-1780)

The version of c-ares installed on the remote host is prior to 1.17.2-1.10. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1780 advisory. A flaw was found in the c-ares package. The aressetsortlist is missing checks about the validity of the input string, which allow...

Amazon Linux AMI : ncurses (ALAS-2023-1778)

The version of ncurses installed on the remote host is prior to 5.7-4.20090207.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1778 advisory. ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security- relevant memory...

Amazon Linux AMI : cups (ALAS-2023-1777)

The version of cups installed on the remote host is prior to 1.4.2-67.22. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1777 advisory. A vulnerability was found in CUPS. This issue occurs due to logging data of free memory to the logging service AFTER the connection...

CVE-2023-34330

AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability...

CVE-2023-34330

AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability...

Design/Logic Flaw

AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability...

CVE-2023-34330 Code injection via Dynamic Redfish Extension interface

AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability...

CVE-2023-34330

CVE-2023-34330 is a code-injection vulnerability in AMI MegaRAC SP-X BMC via the Dynamic Redfish Extension interface. The BMC component and related Redfish functionality can allow an attacker to inject and execute code with high impact on confidentiality, integrity, and availability. NVD lists a ...

CVE-2023-34329

CVE-2023-34329 affects AMI MegaRAC SP-X BMC (SPx12). The vulnerability enables authentication bypass by spoofing the HTTP header, potentially compromising confidentiality, integrity and availability. Documented impact is that an attacker with appropriate access could bypass authentication to perf...

PT-2023-24818 · Ami · Ami Spx

Name of the Vulnerable Software and Affected Versions: AMI SPx affected versions not specified Description: The issue is related to a vulnerability in the BMC of AMI SPx, where a user may inject code that could be executed via a Dynamic Redfish Extension interface. This could lead to a loss of...

AMI MegaRAC 安全漏洞

AMI MegaRAC is a family of service processor products from AMI. Complete out-of-band or unlit remote management of computer systems independent of operating system state or location is available to troubleshoot computers and ensure service continuity. A security vulnerability exists in AMI MegaRA...

PT-2023-24816

Name of the Vulnerable Software and Affected Versions AMI MegaRAC SPx12 affected versions not specified Description The issue allows a user to bypass authentication by spoofing the HTTP header, potentially leading to loss of confidentiality, integrity, and availability. This is achieved by...

AMI MegaRAC SP-X BMC Vulnerabilities - Lenovo Support US

No description provided...

CVE-2023-34473

AMI SPx contains a vulnerability in the BMC where a valid user may cause a use of hard-coded credentials. A successful exploit of this vulnerability may lead to a loss of confidentiality, integrity, and availability...