CVE-2018-9071

Lenovo Chassis Management Module CMM prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration...

Authentication flaw

Lenovo Chassis Management Module CMM prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration...

CVE-2018-9071

CVE-2018-9071 affects Lenovo Chassis Management Module (CMM) prior to version 2.0.0, where unauthenticated users can retrieve information about the current authentication configuration, including password length, expiration, and lockout settings. The vulnerability is confirmed across multiple sou...

CVE-2018-9071 CMM Security Vulnerability

Lenovo Chassis Management Module CMM prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration...

CVE-2018-9073 CMM Security Vulnerability

Lenovo Chassis Management Module CMM prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets...

PT-2018-18832

Name of the Vulnerable Software and Affected Versions Lenovo Chassis Management Module CMM versions prior to 2.0.0 Description The issue allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths,...

PT-2018-18834

Name of the Vulnerable Software and Affected Versions Lenovo Chassis Management Module CMM versions prior to 2.0.0 Description The issue concerns the use of a hardcoded encryption key in the Lenovo Chassis Management Module CMM. This key is used to protect certain secrets. If an attacker obtains...

CVE-2018-9071: Exposure of Sensitive Information to an Unauthorized Actor

Lenovo Chassis Management Module CMM prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration...

CVE-2018-9073: Use of Hard-coded Credentials

Lenovo Chassis Management Module CMM prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets...

CVE-2018-19090

CVE-2018-19090 affects Tianti 2.3, with a stored XSS vulnerability in the article management module that is triggered via the article title. The provided documents consistently describe the issue as a stored XSS in Tianti 2.3’s article title field, without detailing affected versions beyond 2.3 o...

CVE-2018-19091

The CVE-2018-19091 entry concerns Tianti 2.3, where a reflected XSS vulnerability exists in the user management module. The issue is triggered via the tianti-module-admin/user/list userName parameter, enabling an attacker to inject scripts that may execute in a victim’s browser. The available con...

CVE-2018-19090: Improper Neutralization of Input During Web Page Generation

tianti 2.3 has stored XSS in the article management module via an article title...

CVE-2018-19091: Improper Neutralization of Input During Web Page Generation

tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter...

PT-2018-14802

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue is related to stored XSS in the article management module. This occurs via an article title, allowing potential exploitation. Recommendations For version 2.3, update to a newer version that contains a f...

PT-2018-14803

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue is related to reflected XSS in the user management module. It occurs via the userName parameter in the "tianti-module-admin/user/list" endpoint. Recommendations For version 2.3, consider restricting...

CVE-2018-15318

In BIG-IP 14.0.0-14.0.0.2, 13.1.0.4-13.1.1.1, or 12.1.3.4-12.1.3.6, If an MPTCP connection receives an abort signal while the initial flow is not the primary flow, the initial flow will remain after the closing procedure is complete. TMM may restart and produce a core file as a result of this...

Security Bulletin: Vulnerability in libapr1 affects IBM BladeCenter Advanced Management Module (AMM)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerability in libapr1. Vulnerability Details CVEID: CVE-2017-12613 DESCRIPTION: Apache Portable Runtime APR could allow a remote attacker to obtain sensitive information, caused by an out-of-bounds array...

CVE-2018-15311

When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload LRO feature enabled, TMM may crash, leading to a failover event. This vulnerability is not exposed unless LRO is enabled, so most affected...

Security Bulletin: Vulnerabilities in cURL affect IBM BladeCenter Advanced Management Module (AMM)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in cURL. Vulnerability Details CVEID: CVE-2018-1000122 DESCRIPTION: curl could allow a remote attacker to obtain sensitive information, caused by a buffer over-read in the RTSP+RTP handling code. An...

Security Bulletin: Vulnerability in OpenSSL affects IBM BladeCenter Advanced Management Module (AMM)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerability in OpenSSL. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious server...