CVE-2024-36435

An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards and CMM6 modules. An unauthenticated user can post crafted data to the interface that triggers a stack buffer overflow, and may lead to arbitrary remote code execution on a BMC...

CVE-2024-38433: Authentication Bypass by Primary Weakness

Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code execution...

CVE-2024-36435

An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards and CMM6 modules. An unauthenticated user can post crafted data to the interface that triggers a stack buffer overflow, and may lead to arbitrary remote code execution on a BMC...

CVE-2024-36435: Stack-based Buffer Overflow

An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards and CMM6 modules. An unauthenticated user can post crafted data to the interface that triggers a stack buffer overflow, and may lead to arbitrary remote code execution on a BMC...

CVE-2024-36435

CVE-2024-36435 : Affects Supermicro BMC firmware on select X11, X12, H12, B12, X13, H13, B13 motherboards and CMM6 modules. An unauthenticated attacker can send crafted data to the BMC web interface, triggering a stack-based buffer overflow and potentially enabling arbitrary remote code execution...

Security Bulletin: This Power System update is being released to address CVE-2023-48795

Summary This affects the BMC's secure shell SSH interfaces which provides service access to the BMC's command shell, access to the host console, and service access to the hypervisor console. The BMC does not have SSH extensions, so a successful attack will not downgrade client connection security...

Security Bulletin: This Power System update is being released to address CVE-2023-37453

Summary This affects the BMC's physical USB ports. Vulnerability Details CVEID:CVE-2023-37453 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds flaw in the readdescriptors function in drivers/usb/core/sysfs.c in the USB subsystem. By using a specially...

PT-2024-5458 · Nuvoton · Nuvoton Npcm7Xx Bmc Subsystem

Name of the Vulnerable Software and Affected Versions: Nuvoton NPCM7xx BMC subsystem affected versions not specified Description: The issue is related to an authentication bypass weakness in the Nuvoton BootBlock reference code used in the Nuvoton NPCM7xx BMC subsystem. An attacker with write...

PT-2024-6560 · Supermicro · Supermicro Bmc Firmware

Name of the Vulnerable Software and Affected Versions: Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards and CMM6 modules affected versions not specified Description: An issue was discovered in the Supermicro BMC firmware that allows an unauthenticated user to...

CVE-2024-35952 drm/ast: Fix soft lockup

In the Linux kernel, the following vulnerability has been resolved: drm/ast: Fix soft lockup There is a while-loop in astdpsetonoff that could lead to infinite-loop. This is because the register, VGACRI-Dx, checked in this API is a scratch register actually controlled by a MCU, named DPMCU, in BM...

CVE-2024-35952 drm/ast: Fix soft lockup

In the Linux kernel, the following vulnerability has been resolved: drm/ast: Fix soft lockup There is a while-loop in astdpsetonoff that could lead to infinite-loop. This is because the register, VGACRI-Dx, checked in this API is a scratch register actually controlled by a MCU, named DPMCU, in BM...

CVE-2021-35001

BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

CVE-2021-35002

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of...

CVE-2021-35002

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of...

CVE-2021-35001

BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

CVE-2021-35002

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of...

CVE-2021-35001

BMC Track-It! GetData Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

CVE-2021-35002

CVE-2021-35002 (BMC Track-It!) involves an unvalidated processing path for email attachments in Track-It!, enabling an attacker to upload arbitrary files and execute code in the service account context. Affected software is BMC Track-It! (Track-It! helpdesk/asset management product). The root cau...

CVE-2021-35002 BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of...

CVE-2021-35002 BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability

BMC Track-It! Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It!. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of...