CVE-2020-11483

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which the firmware includes hard-coded credentials, which may lead to elevation of privileges or information...

CVE-2020-11484

CVE-2020-11484 affects NVIDIA DGX-1 (and DGX-2, DGX A100) with AMI BMC firmware older than 3.38.30. The vulnerability allows an attacker with administrative privileges to obtain the hash of the BMC/IPMI user password, potentially leading to information disclosure. NVIDIA’s security bulletin docum...

CVE-2020-11485

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery CSRF vulnerability in the AMI BMC firmware in which the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the...

CVE-2020-11485

CVE-2020-11485 affects NVIDIA DGX systems (notably DGX-1) with AMI BMC firmware versions prior to 3.38.30. The vulnerability is a Cross-Site Request Forgery (CSRF) in the BMC web interface, where the application does not sufficiently verify that a request is intentional, potentially enabling info...

Security Bulletin: AMI Baseboard Management Controller (BMC) Firmware Vulnerabilities in NVIDIA DGX-1, DGX-2, and DGX A100 Servers - October 2020

NVIDIA has released a firmware security update for NVIDIA DGX™ servers. This update addresses security issues in the AMI Baseboard Management Controller BMC firmware that may lead to remote code execution, elevation of privileges, or information disclosure. All issues require network access to th...

kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c

A memory leak problem was found in ipmibmcregister in drivers/char/ipmi/ipmimsghandler.c in Intelligent Platform Management Interface IPMI which is used for incoming and outgoing message routing purpose. This flaw may allow an attacker with minimal privilege to cause a denial of service by...

kernel: Denial Of Service in the __ipmi_bmc_register() function in drivers/char/ipmi/ipmi_msghandler.c

A memory leak problem was found in ipmibmcregister in drivers/char/ipmi/ipmimsghandler.c in Intelligent Platform Management Interface IPMI which is used for incoming and outgoing message routing purpose. This flaw may allow an attacker with minimal privilege to cause a denial of service by...

CVE-2020-8340

CVE-2020-8340 is an XSS vulnerability in legacy IBM/Lenovo System x IMM2 (BMC web interface) prior to firmware 5.60. Exploitation requires convincing the user to visit a crafted URL while the user is authenticated; the injected JavaScript executes in the user’s browser, not on IMM2. Documented im...

CVE-2020-8340

A cross-site scripting XSS vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 Integrated Management Module 2, prior to version 5.60, embedded Baseboard Management Controller BMC web interface during an internal security review. This vulnerability could allow JavaScript code t...

CVE-2020-8573

The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers BMC are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on t...

Default credentials

The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers BMC are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on t...

CVE-2020-8573

The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers BMC are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on t...

CVE-2020-8573

NetApp HCI BMCs (H610C, H615C, H610S) ship with a documented default account/password. During upgrades to Element 11.8/12.0 or Compute Firmware Bundle 12.2.92, the BMC password is reset to the default, which could allow remote attackers to cause a Denial of Service (DoS). This cobalt of informati...

AMI MegaRAC SP-X BMC Redfish Authentication Bypass - Lenovo Support US

Lenovo Security Advisory: LEN-31072 Potential Impact: Privilege escalation, information disclosure Severity: High Scope of Impact: Industry-wide CVE Identifier: No CVE Summary Description: AMI has released AMI MegaRAC SP-X Baseboard Management Controller BMC security enhancements to address...

AMI MegaRAC SP-X BMC Redfish Authentication Bypass - Lenovo Support US

No description provided...

CentOS: Security Advisory for bmc-snmp-proxy (CESA-2020:0984)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

bmc, exchange, ipmitool security update

CentOS Errata and Security Advisory CESA-2020:0984 An update for ipmitool is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Information Disclosure

file is vulnerable to information disclosure. The vulnerability exists as BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage...

BMC Control-M/Agent Buffer Overflow Vulnerability

Control-M is one of BMC's most important automation control products, and is the world's leading integrated business scheduling solution for cross-platform and cross-application job scheduling. A buffer overflow vulnerability exists in BMC Control-M/Agent when the On-Do action destination is Mail...

BMC Control-M/Agent Command Injection Vulnerability

Control-M is one of BMC's most important automation control products, and is the world's leading integrated business scheduling solution for cross-platform and cross-application job scheduling. A security vulnerability exists in BMC Control-M/Agent when using the TCP protocol, which can be...