CVE-2022-28866

Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI R18 Firmware v4.13.00. It does not properly validate requests for access to or editing of data and functionality in all endpoints under /settings/ and /api/settings/. By not verifying the permissions for access to...

Improper access control

Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI R18 Firmware v4.13.00. It does not properly validate requests for access to or editing of data and functionality in all endpoints under /settings/ and /api/settings/. By not verifying the permissions for access to...

Information Disclosure

fwupd is vulnerable to information disclosure. The vulnerability exists when creating an OPERATOR user account on the BMC, allowing an attacker to read the the configuration files on the system...

PT-2022-19270 · Nokia · Nokia Airframe Bmc Web Gui

Name of the Vulnerable Software and Affected Versions: Nokia AirFrame BMC Web GUI versions prior to R18 Firmware v4.13.00 Description: A security issue was found in the software, related to improper access control. It does not correctly validate requests to access or edit data and functionality i...

CVE-2022-28866

The affected component is Nokia AirFrame BMC Web GUI (R18 firmware) prior to v4.13.00. The issue is improper access control in API endpoints under /#settings/* and /api/settings/*, where requests are not properly validated for permissions. This can allow an attacker to view pages with sensitive d...

Nokia AirFrame BMC 安全漏洞

Nokia AirFrame BMC is a high-performance and energy-efficient solution from Nokia of Finland. Designed for scalable data centers and heavy workloads. A security vulnerability exists in the R18 Firmware v4.13.00 version of the Nokia AirFrame BMC Web GUI, which stems from a failure to properly...

CVE-2022-3287

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...

CVE-2022-3287

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...

CVE-2022-3287

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...

CVE-2022-3287

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...

CVE-2022-3287

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...

CVE-2022-3287

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...

CVE-2022-3287

CVE-2022-3287 affects fwupd where the Redfish plugin saved the auto-generated BMC password to /etc/fwupd/redfish.conf with insufficient access restriction, enabling any local user to read the password. Impact is confidentiality of credentials (high), with no remote exploitation details provided i...

CVE-2022-3287

A flaw was found in fwupd. When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...

CVE-2022-3287

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file...

Security Bulletin: Mitigations are being announced to address CVE-2020-4839 and CVE-2021-29695

Summary IBM products 8335-GCA, 8335-GTA, and 8335-GTB have identified security vulnerabilities. Vulnerability Details CVEID:CVE-2020-4839 DESCRIPTION: IBM Host firmware for LC-class Systems is vulnerable to a stack based buffer overflow, caused by improper bounds checking. A remote privileged...

AMI MegaRAC SP-X BMC Vulnerabilities - Lenovo Support US

No description provided...

Security Bulletin: This Power System update is being released to address CVE-2019-16649 and CVE-2019-16650

Summary POWER8 and POWER9: In response to security issues with virtual media, new Power System firmware updates are being released to address Common Vulnerabilities and Exposures issue numbers CVE-2019-16649 and CVE-2019-16650. Vulnerability Details CVEID:CVE-2019-16649 DESCRIPTION: Multiple...

CVE-2021-29891

IBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity certificate that may cause it to lose network services. IBM X-Force ID: 207221...

CVE-2022-35864

This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of...