CVE-2025-36125

CVE-2025-36125 (IBM HMC - Power) affects IBM Hardware Management Console for Power versions 10.3.1050.0 and 11.1.1110.0. It is a stored cross-site scripting vulnerability (CWE-79) that allows an authenticated user to inject arbitrary JavaScript into the Web UI, potentially leading to credentials ...

Security Bulletin: Vulnerabilities in glib2 library (CVE-2024-52533, CVE-2025-4373) affect Power HMC.

Summary The glib2 library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2024-52533 DESCRIPTION: gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4CONNMSGLEN...

Security Bulletin: Vulnerabilities in libxml2 library (CVE-2025-6021, CVE-2025-49794, CVE-2025-49796) affect Power HMC.

Summary The libxml2 library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-6021 DESCRIPTION: A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a...

Security Bulletin: Vulnerability in sudo library (CVE-2025-32462) affects Power HMC.

Summary The sudo library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-32462 DESCRIPTION: Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows liste...

Security Bulletin: Vulnerability in pam library (CVE-2025-6020) affects Power HMC.

Summary The pam library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-6020 DESCRIPTION: A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing...

Security Bulletin: Vulnerability in libxml2 library (CVE-2025-32414) affects Power HMC.

Summary The libxml2 library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-32414 DESCRIPTION: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API Python bindings...

Security Bulletin: Vulnerability in libxslt library (CVE-2023-40403) affects Power HMC.

Summary The libxslt library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-40403 DESCRIPTION: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadO...

Security Bulletin: Vulnerabilities in libsoup library (CVE-2025-2784, CVE-2025-4948, CVE-2025-32049, CVE-2025-32914) affect Power HMC.

Summary The libsoup library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-2784 DESCRIPTION: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the...

CVE-2025-42958

Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. This results in a high impact on the...

IBM Hardware Management Console - Power 跨站脚本漏洞

IBM Hardware Management Console - Power is a hardware appliance from International Business Machines IBM used to configure and control IBM Power Systems servers. A cross-site scripting vulnerability exists in IBM Hardware Management Console - Power versions 10.3.1050.0 and 11.1.1110.0, which...

CVE-2024-21970

Improper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentially leading to a loss of integrity...

RLSA-2025:14750 Moderate: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: requests: Requests vulnerable to .netrc credentials leak via malicious...

fence-agents security update

An update is available for fence-agents. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...

CVE-2024-21970

Improper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potentially leading to a loss of integrity...

CVE-2024-36346

Improper input validation in AMD Power Management Firmware PMFW could allow a privileged attacker from Guest VM to send arbitrary input data potentially causing a GPU Reset condition...

CVE-2024-36346

Improper input validation in AMD Power Management Firmware PMFW could allow a privileged attacker from Guest VM to send arbitrary input data potentially causing a GPU Reset condition...

CVE-2024-36346

Improper input validation in AMD Power Management Firmware PMFW could allow a privileged attacker from Guest VM to send arbitrary input data potentially causing a GPU Reset condition...

CVE-2024-36346

CVE-2024-36346 concerns AMD Power Management Firmware (PMFW). The issue is caused by improper input validation , enabling a privileged attacker from a Guest VM to send arbitrary input data and potentially induce a GPU reset . The CVSSv3.1 metrics (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) indicate a l...

CVE-2024-21970

CVE-2024-21970 describes improper validation of an array index in the AND power Management Firmware, causing possible AGESA memory corruption and loss of integrity when exploited by a privileged attacker. Connected documents identify affected AMD Client Processor platforms and indicate mitigation...

CVE-2023-31306

Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamic power management DPM functions resulting in an out of bounds read and loss of availability...