CVE-2020-11485

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery CSRF vulnerability in the AMI BMC firmware in which the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the...

CVE-2020-11484

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure...

CVE-2020-11615

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, which may lead to information disclosure...

CVE-2020-8340

CVE-2020-8340 is an XSS vulnerability in legacy IBM/Lenovo System x IMM2 (BMC web interface) prior to firmware 5.60. Exploitation requires convincing the user to visit a crafted URL while the user is authenticated; the injected JavaScript executes in the user’s browser, not on IMM2. Documented im...

CVE-2020-8340: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 Integrated Management Module 2, prior to version 5.60, embedded Baseboard Management Controller BMC web interface during an internal security review. This vulnerability could allow JavaScript code t...

PT-2020-20107

Name of the Vulnerable Software and Affected Versions IBM and Lenovo System x IMM2 versions prior to 5.60 Description A cross-site scripting XSS issue was found in the legacy IBM and Lenovo System x IMM2 embedded Baseboard Management Controller BMC web interface. This could allow JavaScript code ...

Critical Intel Flaw Afflicts Several Motherboards, Server Systems, Compute Modules

Intel is warning of a rare critical-severity vulnerability affecting several of its motherboards, server systems and compute modules. The flaw could allow an unauthenticated, remote attacker to achieve escalated privileges. The recently patched flaw CVE-2020-8708 ranks 9.6 out of 10 on the CVSS...

CVE-2020-8573

The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers BMC are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on t...

CVE-2020-8573

NetApp HCI BMCs (H610C, H615C, H610S) ship with a documented default account/password. During upgrades to Element 11.8/12.0 or Compute Firmware Bundle 12.2.92, the BMC password is reset to the default, which could allow remote attackers to cause a Denial of Service (DoS). This cobalt of informati...

PT-2020-20216

Name of the Vulnerable Software and Affected Versions NetApp HCI H610C, H615C, and H610S Baseboard Management Controllers BMC versions prior to the version where the default password reset issue is fixed Description The issue concerns a default account and password in the NetApp HCI H610C, H615C,...

CVE-2020-8573: Use of Hard-coded Credentials

The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers BMC are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on t...

NetApp Service Processor and NetApp Baseboard Management Controller Denial of Service Vulnerabilities

NetApp Service Processor and NetApp Baseboard Management Controller are both products of NetApp, Inc.NetApp Service Processor is a remote management device. The product provides node remote management capabilities, including console redirection, logging, and power control.NetApp Baseboard...

CVE-2019-5500

CVE-2019-5500 concerns NetApp’s Service Processor (SV) and Baseboard Management Controller (BMC) firmware. Connected documents confirm a remote, unauthenticated attacker can cause a Denial of Service (DoS) on affected devices. The impact is described as DoS, with CVSS metrics indicating a Network...

PT-2020-11142

Name of the Vulnerable Software and Affected Versions NetApp Service Processor and Baseboard Management Controller firmware affected versions not specified Description The issue allows a remote unauthenticated attacker to cause a Denial of Service DoS. Recommendations At the moment, there is no...

CVE-2019-5500: Undefined Security Weakness

Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthenticated attacker to cause a Denial of Service DoS...

HPESBHF03934 rev.1 - HPE CloudLIne servers using AMI BMC Remote Unauthorized Disclosure of Information, Unauthorized Modification and Denial of Service

Potential Security Impact: Remote: Denial of Service DoS, Disclosure of Information, Unauthorized Modification SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Cloudline CL2100 Gen10 Server - Prior to Baseboard Management Controller BMC 1.16.0.030 Apr 2019 - No BIOS update is...

CVE-2019-17274

NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller BMC firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access...

CVE-2019-17274

NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller BMC firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access...

CVE-2019-17274: Initialization of a Resource with an Insecure Default

NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller BMC firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access...

PT-2020-9888

Name of the Vulnerable Software and Affected Versions NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller BMC firmware versions prior to 13.1P1 Description The issue allows unauthorized arbitrary command execution via local access due to a default account being enabled...