839 matches found
Security Bulletin: Vulnerabilities in OpenSSL affect System x Integrated Management Module (IMM) (CVE-2015-0204)
Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by System x Integrated Management Module IMM. IMM hasaddressed the applicable CVEs...
Security Bulletin: IBM BladeCenter Advanced Management Module is affected by libxml2 vulnerabilities (CVE-2014-0191, CVE-2013-2877, CVE-2014-3660)
Summary Security vulnerabilities libxml2 affect IBM BladeCenter Advanced Management Module. Vulnerability Details Summary Security vulnerabilities libxml2 affect IBM BladeCenter Advanced Management Module. Vulnerability Details: CVE-ID: CVE-2014-0191 Description: Libxml2 is vulnerable to a denial...
Security Bulletin: Vulnerability in SSLv3 affects Chassis Management Module (CMM) (CVE-2014-3566)
Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Chassis Management Module CMM. Vulnerability Details Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On...
Security Bulletin: Multiple potential vulnerabilities in OpenSSL fixed in Chassis Management Module (CMM) (CVE-2014-3509, CVE-2014-3506, CVE-2014-3507, CVE-2014-3511, CVE-2014-3505, CVE-2014-3510, CVE-2014-3508)
Summary OpenSSL disclosed several vulnerabilities in August 2014. Seven of those vulnerabilities apply to the version of OpenSSL used by Flex Systems Chassis Management Module CMM. Vulnerability Details Abstract OpenSSL disclosed several vulnerabilities in August 2014. Seven of those...
Security Bulletin: The IBM Chassis Management Module (CMM) is affected by a vulnerability in NTP server (CVE-2013-5211)
Summary A security vulnerability has been discovered in the Chassis Management Module NTP Server. Vulnerability Details Abstract A security vulnerability has been discovered in the Chassis Management Module NTP Server. Content Vulnerability Details: CVE-ID: CVE-2013-5211 Description: The monlist...
Security Bulletin: IBM Flex System Chassis Management Module (CMM) is affected by the following OpenSSL vulnerability: CVE-2014-0224
Summary An interface on the IBM BladeCenter Advanced Management Module AMM may expose user account names and passwords that have been configured on that AMM. Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL...
Security Bulletin: IBM System x and Flex Systems OpenSSH Vulnerabilities (CVE-2012-0814, CVE-2008-5161)
Summary Older versions of OpenSSH, used by several System x and Flex Systems products, contain multiple vulnerabilities. Vulnerability Details Abstract Older versions of OpenSSH, used by several System x and Flex Systems products, contain multiple vulnerabilities. Content Vulnerability Details:...
Default credentials
In System Management Module SMM versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability...
CVE-2018-16091
In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows...
CVE-2018-16089
In System Management Module SMM versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user...
CVE-2018-9083
In System Management Module SMM versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability...
CVE-2018-16095
In System Management Module SMM versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails...
Cross site scripting
In System Management Module SMM versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting...
Buffer overflow
In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows...
CVE-2018-9084
In System Management Module SMM versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented...
CVE-2018-16091
In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows...
Input validation
In System Management Module SMM versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented...
CVE-2018-16094
In System Management Module SMM versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow...
CVE-2018-9083
In System Management Module SMM versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability...