HPESBHF04314 rev.4 - HPE Superdome Flex, Superdome Flex 280, Integrity MC990 X, SGI UV 300 Servers and SGI UV 3000 Servers Using Certain Intel Processor BIOS, INTEL-SA-00601, 2022.1 IPU – Intel BIOS Advisory, Multiple Local Vulnerabilities

Potential Security Impact: Local: Disclosure of Information, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrity MC990 X Server - Prior to 5.2.16 BIOS in product bundle 2022.06 - Impacted by CVE-2021-0154, CVE-2021-0155, CVE-2021-0189 HPE Superdom...

Vulnerabilities fixed in HPE ProLiant Intel BIOS

Vulnerabilities have been fixed in the Intel BIOS of HPE ProLiant DX servers. The vulnerabilities in DX Gen 10 servers with features DX170r, DX190r, DX360, DX380, DX560 and DX4200 allow a local malicious person able to obtain sensitive information or increase privileges. HPE has made updates...

PT-2022-10688 · Hewlett Packard · Hp Pc

Name of the Vulnerable Software and Affected Versions: HP PC products affected versions not specified Description: Potential security vulnerabilities have been identified in the BIOS UEFI Firmware for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware...

PT-2022-10687 · Hewlett Packard · Hp Pc

Name of the Vulnerable Software and Affected Versions: HP PC products affected versions not specified Description: The issue concerns potential security vulnerabilities in the BIOS UEFI Firmware of certain HP PC products. These vulnerabilities might allow arbitrary code execution. HP is releasing...

2020.2 IPU – Intel® CSME, SPS, TXE, and AMT Advisory

Summary: Potential security vulnerabilities in Intel® Converged Security and Manageability Engine CSME, Server Platform Services SPS, Intel® Trusted Execution Engine TXE, Intel® Dynamic Application Loader DAL, Intel® Active Management Technology AMT, Intel® Standard Manageability ISM and Intel®...

2021.1 IPU – Intel® CSME, SPS and LMS Advisory

Summary: Potential security vulnerabilities in the Intel® Converged Security and Manageability Engine CSME, Server Platform Services SPS, and Intel® Local Manageability Service Intel® LMS may allow escalation of privilege or information disclosure. Intel is releasing firmware and software updates...

Intel 2022.1 IPU - Intel® Boot Guard and Intel® TXT Security Updates

Intel has informed HP of potential vulnerabilities identified in Intel® Boot Guard and Intel® Trusted Execution Technology TXT for some Intel® processors, which might allow escalation of privilege. Intel is releasing firmware updates and prescriptive guidance to mitigate these potential...

Intel 2022.1 IPU BIOS Security Updates

Intel has informed HP of potential security vulnerabilities identified in some Intel® Processors, in BIOS firmware or BIOS authenticated code module for some Intel® Processors, and in the Intel® Software Guard Extensions SGX Platform which may allow escalation of privilege, information disclosure...

2022.1 IPU - Intel® Xeon® Advisory

Summary: Potential security vulnerabilities in some Intel® Xeon® Processors may allow information disclosure or denial of service. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2022-21131 Description: Improper access control for...

2022.1 IPU - Intel® Boot Guard and Intel® TXT Advisory

Summary: A potential security vulnerability in Intel® Boot Guard and Intel® Trusted Execution Technology TXT for some Intel® processors may allow escalation of privilege. Intel is releasing firmware updates and prescriptive guidance to mitigate this potential vulnerability. Vulnerability Details:...

D-Link DIR-825 G1 Access Control Error Vulnerability

The DIR-825 G1 is a router from D-Link in Taiwan, China. An access control error vulnerability exists in the firmware version of the D-Link DIR-825 G1, which stems from insufficient authentication. The vulnerability can be exploited to bypass authentication via the parameter "autoupgrade.asp" and...

Microsoft best practices for managing IoT security concerns

The Internet of Things, or IoT, has expanded beyond the mere concept that it was when first introduced. IoT is now part of most individuals’ daily activities, from smart speakers and thermostats to smartwatches and vehicles. IoT devices and systems bring massive convenience and functionality. IoT...

Lenovo issues fixes for laptop backdoors

Researchers have discovered three vulnerabilities affecting various Lenovo consumer laptop models. The vulnerabilities were found in UEFI firmware drivers originally meant to be used only during the manufacturing process, along with a vulnerability in the SW SMI handler function. The list of...

Keeping A Critical Eye on IoT Devices

Keeping a Critical Eye on IoT Devices By Sam Quinn · April 21, 2022 Trellix Labs is excited to announce the beginning of a new video series which captures one of our senior vulnerability researchers work on hacking an IoT device from beginning to end. This will conclude with the releasing of a ne...

Input validation

An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper...

CVE-2020-25166

CVE-2020-25166 concerns an improper verification of the cryptographic signature for firmware updates in B. Braun SpaceCom devices (SpaceCom, Battery Pack with Wi‑Fi) and Data module compactplus (versions L81/U61 and A10/A11). The root cause is signature verification weakness, allowing attackers t...

Zyxel Releases Patches for Critical Bug Affecting Business Firewall and VPN Devices

Networking equipment maker Zyxel has pushed security updates for a critical vulnerability affecting some of its business firewall and VPN products that could enable an attacker to take control of the devices. "An authentication bypass vulnerability caused by the lack of a proper access control...

Bugs in Wyze Cams Could Let Attackers Takeover Devices and Access Video Feeds

Three security vulnerabilities have been disclosed in the popular Wyze Cam devices that grant malicious actors to execute arbitrary code and access camera feeds as well as unauthorizedly read the SD cards, the latter of which remained unresolved for nearly three years after the initial discovery...

Warning — Deadbolt Ransomware Targeting ASUSTOR NAS Devices

ASUSTOR network-attached storage NAS devices have become the latest victim of Deadbolt ransomware, less than a month after similar attacks singled out QNAP NAS appliances. In response to the infections, the company has released firmware updates ADM 4.0.4.RQO2 to "fix related security issues." The...

Security Bulletin: A vulnerability in net-snmp affects IBM Security Network Intrusion Prevention System (CVE-2015-5621)

Summary The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol SNMP.One security vulnerability has been discovered in net-snmp used with IBM Security Network Intrusion Prevention System. Vulnerability Details CVEID: CVE-2015-5621 DESCRIPTION: Net-SNMP...