Amazon Linux AMI : ruby24 (ALAS-2020-1451)

The version of ruby24 installed on the remote host is prior to 2.4.10-2.13. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1451 advisory. An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundle...

Amazon Linux AMI : kernel (ALAS-2020-1446)

The version of kernel installed on the remote host is prior to 4.14.203-116.332. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1446 advisory. In binderreleasework of binder.c, there is a possible use-after-free due to improper locking. This could lead to...

Multi-vendor BIOS Security Vulnerabilities (November 2020) - Lenovo Support US

No description provided...

NVIDIA Patches Critical Bug in High-Performance Servers

NVIDIA released a patch for a critical bug in its high-performance line of DGX servers that could open the door for a remote attacker to take control of and access sensitive data on systems typically operated by governments and Fortune-100 companies. In all, NVIDIA issued nine patches, each fixin...

CVE-2020-11486

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution...

Information disclosure

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in the AMI BMC firmware in which default SNMP community strings are used, which may lead to information disclosure...

Information disclosure

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator PRNG algorithm used in the JSOL package that implements the IPMI protocol is not cryptographically strong, which may lead to information...

Information disclosure

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure...

Design/Logic Flaw

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead t...

CVE-2020-11615

NVIDIA DGX servers with AMI BMC firmware older than 3.38.30 are affected by CVE-2020-11615 due to a hard-coded RC4 cipher key in the AMI BMC firmware, which may lead to information disclosure. The NVIDIA security bulletin lists BMC firmware updates to 3.38.30 (and related DGX models) as the remed...

CVE-2020-11615

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, which may lead to information disclosure...

CVE-2020-11616

CVE-2020-11616 affects NVIDIA DGX servers with BMC firmware versions prior to 3.38.30. The vulnerability arises from a weak PRNG in the JSOL IPMI package of the AMI BMC firmware, which could lead to information disclosure. Public documents identify the affected product class but do not provide ex...

CVE-2020-11488

CVE-2020-11488 affects NVIDIA DGX-1 and DGX-2 systems where the AMI BMC firmware before the stated versions does not validate the RSA-1024 public key used to verify firmware signatures, enabling potential information disclosure or code execution. Public details from NVIDIA/NVD indicate DGX-1 BMC ...

CVE-2020-11486

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution...

CVE-2020-11486

CVE-2020-11486 (NVIDIA DGX BMC): A vulnerability in the AMI Baseboard Management Controller (BMC) firmware on DGX-1 (and related DGX models) allows an attacker to upload or transfer files that can be automatically processed within the product’s environment, potentially enabling remote code execut...

CVE-2020-11487

CVE-2020-11487 affects NVIDIA DGX-1, DGX-2, and DGX A100 servers via AMI BMC firmware with a hard-coded RSA 1024 key and weak ciphers, leading to information disclosure over the BMC. Affected firmware is before 3.38.30 (DGX-1), before 1.06.06 (DGX-2), and before 00.13.16 (DGX A100). NVIDIA provid...

CVE-2020-11484

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure...

CVE-2020-11483

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which the firmware includes hard-coded credentials, which may lead to elevation of privileges or information...

CVE-2020-11484

CVE-2020-11484 affects NVIDIA DGX-1 (and DGX-2, DGX A100) with AMI BMC firmware older than 3.38.30. The vulnerability allows an attacker with administrative privileges to obtain the hash of the BMC/IPMI user password, potentially leading to information disclosure. NVIDIA’s security bulletin docum...

Security Bulletin: AMI Baseboard Management Controller (BMC) Firmware Vulnerabilities in NVIDIA DGX-1, DGX-2, and DGX A100 Servers - October 2020

NVIDIA has released a firmware security update for NVIDIA DGX™ servers. This update addresses security issues in the AMI Baseboard Management Controller BMC firmware that may lead to remote code execution, elevation of privileges, or information disclosure. All issues require network access to th...