Design/Logic Flaw

A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be...

Security Bulletin: IBM MegaRAID Storage Manager is affected by a vulnerability in TLS (CVE-2019-6485)

Summary The following vulnerability in TLS has been addressed by IBM MegaRAID Storage Manager. Vulnerability Details CVEID: CVE-2019-6485 DESCRIPTION: Citrix NetScaler Application Delivery Controller and NetScaler Gateway could allow a remote attacker to obtain sensitive information, caused by a...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in OpenSSL (CVE-2012-4929)

Summary The following vulnerability in OpenSSL has been addressed by IBM Integrated Management Module II IMM2. Vulnerability Details CVEID: CVE-2012-4929 DESCRIPTION: The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome,Qt, and other products, can encrypt compressed data...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by a libcurl security vulnerability (CVE-2019-5482)

Summary IBM Integrated Management Module II IMM2 is affected by a libcurl security vulnerability CVE-2019-5482 Vulnerability Details CVEID: CVE-2019-5482 DESCRIPTION: cURL libcurl is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the tftpreceivepacket function. ...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by Linux kernel vulnerability (CVE-2019-11477)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following Linux kernel vulnerability. Vulnerability Details CVEID: CVE-2019-11477 DESCRIPTION: Jonathan Looney discovered that the TCPSKBCBskb-tcpgsosegs value was subject to an integer overflow in the Linux kernel when...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in libxml2 (CVE-2018-14404 CVE-2016-9318)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in libxml2. Vulnerability Details CVEID: CVE-2018-14404 DESCRIPTION: A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval function of libxml2 through 2.9.8 when parsing ...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in PHP (CVE-2019-6977) (CVE-2019-6978)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in PHP Vulnerability Details CVEID: CVE-2019-6978 DESCRIPTION: The GD Graphics Library aka LibGD 2.2.5 has a double free in the gdImagePtr functions in gdgifout.c, gdjpeg.c, and gdwbmp.c. NOTE: PHP ...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerability in PHP (CVE-2018-19518)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerability in PHP. Vulnerability Details CVEID: CVE-2018-19518 DESCRIPTION: University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of...

BKS EBK Ethernet-Buskoppler Pro Shell Upload Vulnerability

BKS EBK Ethernet-Buskoppler Pro versions prior to 3.01 suffer from a remote shell upload vulnerability. Product: BKS EBK Ethernet-Buskoppler Pro Manufacturer: BKS GmbH Affected Versions: 3.01 Vulnerability Type: Unrestricted Upload of File with Dangerous Type CWE-434 Risk Level: High Solution...

Security Bulletin: IBM QRadar Network Security is affected by a an openssl vulnerability (CVE-2018-5407)

Summary IBM QRadar Network Security has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2018-5407 DESCRIPTION: Multiple SMT/Hyper-Threading architectures and processors could allow a local attacker to obtain sensitive information, caused by execution engine sharing on...

CVE-2019-11353

The EnGenius EWS660AP router with firmware 2.0.284 allows an attacker to execute arbitrary commands using the built-in ping and traceroute utilities by using different payloads and injecting multiple parameters. This vulnerability is fixed in a later firmware version...

Security Bulletin: IBM NeXtScale Fan Power Controller (FPC) is affected by vulnerability in OpenSSL (CVE-2018-0734)

Summary IBM NeXtScale Fan Power Controller FPC has addressed the following vulnerability in OpenSSL. Vulnerability Details CVEID: CVE-2018-0734 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by a timing side channel attack in the DSA signature algorithm...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerability in GNU glibc (CVE-2018-11236)

Summary IBM Advanced Management Module AMM has addressed the following vulnerability in GNU glibc. Vulnerability Details CVEID: CVE-2018-11236 DESCRIPTION: GNU glibc is vulnerable to a stack-based buffer overflow, caused by improper bounds of checking by the pathname arguments in the realpath...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in GNU glibc (CVE-2017-15804 CVE-2017-15670 CVE-2015-5180)

Summary IBM Advanced Management Module AMM has addressed the following vulnerabilities in GNU glibc. Vulnerability Details CVEID: CVE-2017-15804 DESCRIPTION: GNU C Library aka glibc or libc6 is vulnerable to a buffer overflow, caused by improper bounds checking by glob function in glob.c. By usin...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in python (CVE-2018-1061 CVE-2018-1060 CVE-2016-5636)

Summary IBM Advanced Management Module AMM has addressed the following vulnerabilities in python. Vulnerability Details CVEID: CVE-2018-1061 DESCRIPTION: Python is vulnerable to a denial of service, caused by catastrophic backtracking in the difflib.ISLINEJUNK method. A remote attacker could...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in X.Org libx11 (CVE-2018-14599 CVE-2018-14598)

Summary IBM Advanced Management Module AMM has addressed the following vulnerabilities in X.Org libx11. Vulnerability Details CVEID: CVE-2018-14599 DESCRIPTION: X.Org libx11 is vulnerable to a denial of service, caused by an off-by-one flaw in multiple functions. By sending malicious server...

Security Bulletin: IBM BladeCenter Advanced Management Module (AMM) is affected by vulnerabilities in cURL (CVE-2018-16840 CVE-2018-16842)

Summary IBM Advanced Management Module AMM has addressed the following vulnerabilities in cURL. Vulnerability Details CVEID: CVE-2018-16842 DESCRIPTION: cURL could allow a remote attacker to obtain sensitive information, caused by a heap-based buffer over-read in the display function in the comma...

Security Bulletin: IBM RackSwitch firmware products are affected by vulnerability in OpenSSL (CVE-2018-0732)

Summary IBM RackSwitch firmware products listed below have addressed the following vulnerability in OpenSSL. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server...

Security Bulletin: Vulnerability in Enterprise Networking Operating System (ENOS) affects IBM RackSwitch Products (CVE-2017-3765)

Summary IBM RackSwitch Products have addressed the following vulnerability in Enterprise Networking Operating System ENOS. Vulnerability Details Summary IBM RackSwitch Products have addressed the following vulnerability in Enterprise Networking Operating System ENOS. Vulnerability Details CVEID:...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Unified Extensible Firmware Interface (UEFI) (CVE-2017-3735 CVE-2017-3736)

Summary IBM Unified Extensible Firmware Interface UEFI has addressed the following vulnerabilities in OpenSSL. Vulnerability Details Summary IBM Unified Extensible Firmware Interface UEFI has addressed the following vulnerabilities in OpenSSL. Vulnerability Details CVEID: CVE-2017-3735 Descriptio...