Security Bulletin: This Power System update is being released to address CVE-2018-13787

Summary POWER8/POWER9: In response to a potential issue with validation checking of IBM firmware, a new firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-13787. Vulnerability Details CVEID: CVE-2018-13787 DESCRIPTION: Certain Supermicro X11S,...

Security Bulletin: This Power System update is being released to address CVE-2018-8931

Summary POWER8/POWER9: In response to a security bypass vulnerability, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-8931. Vulnerability Details CVEID: CVE-2018-8931 DESCRIPTION: The AMD Ryzen, Ryzen Pro, and Ryzen Mobil...

Security Bulletin: This Power System update is being released to address CVE 2021-3450 and CVE 2021-3449

Summary POWER9: In response to security issues with BMC's HTTPS server, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue numbers CVE 2021-3450 and CVE 2021-3449. Vulnerability Details CVEID: CVE-2021-3450 DESCRIPTION: OpenSSL could allow a...

Security Bulletin: This Power System update is being released to address CVE 2020-25705

Summary POWER9: In response to security issues with BMC's UDP network service, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2020-25705. Vulnerability Details CVEID: CVE-2020-25705 DESCRIPTION: Linux Kernel could allow a remo...

Security Bulletin: Incorrect file permissions allows authenticated users to recover IPMI user passwords

Summary A flaw in the file permissions may expose IPMI user passwords. This may lead to privilege escalations. Vulnerability Details CVEID: CVE-2020-14156 DESCRIPTION: OpenBMC phosphor-host-ipmid could allow a remote authenticated attacker to bypass security restrictions, caused by the failure to...

The vulnerability of the Power BI report server, related to errors in information presentation by the user interface, allows a perpetrator to perform spear-phishing attacks.

The vulnerability of the Power BI report server is related to errors in the way information is presented by the user interface. Exploiting this vulnerability allows a malicious actor to carry out spoofing attacks remotely...

Solar-Log 500 安全漏洞

Solar-Log is a data logger used to monitor photovoltaic power plants from Solar-Log GmbH in Germany. Solar-Log 500 has a security vulnerability that could be exploited by an attacker with access to the device to read sensitive information...

Security Bulletin: This Power System update is being released to address CVE 2020-16166

Summary POWER9: In response to a security issue with BMC's network service, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2020-16166. Vulnerability Details CVEID: CVE-2020-16166 DESCRIPTION: Linux Kernel could allow a remote...

Security Bulletin: This Power System update is being released to address CVE 2021-39296

Summary POWER9: In response to a security issue with BMC's IPMI LAN+ interface, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2021-39296. Vulnerability Details CVEID: CVE-2021-39296 DESCRIPTION: OpenBMC could allow a remote...

Security Bulletin: This Power System update is being released to address CVE 2020-1971

Summary POWER9: In response to a security issue with BMC's HTTPS server, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2020-1971. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of...

Schneider Electric SESU

1. EXECUTIVE SUMMARY CVSS v3 3.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Schneider Electric Software Update SESU Vulnerability: Insufficient Entropy 2. RISK EVALUATION Successful exploitation of this vulnerability could cause unintended connection from an internal...

CVE-2021-26334

The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user...

USN-5155-1 bluez vulnerabilities

It was discovered that BlueZ incorrectly handled the Discoverable status when a device is powered down. This could result in devices being powered up discoverable, contrary to expectations. This issue only affected Ubuntu 20.04 LTS, Ubuntu 21.04, and Ubuntu 21.10. CVE-2021-3658 It was discovered...

Security Bulletin: Vulnerability in MIT Kerberos 5 (CVE-2020-28196) affects HMC

Summary MIT Kerberos 5 krb5 is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-28196 DESCRIPTION: MIT Kerberos 5 aka krb5 is vulnerable to a denial of service, caused by an unbounded recursion flaw in...

Security Bulletin: Vulnerability in glib2 (CVE-2021-27218 and CVE-2021-27219) affects Power HMC

Summary glib2 is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2021-27218 DESCRIPTION: GNOME GLib is vulnerable to a denial of service, caused by an error when invoking gbytearraynewtake with a buffer of 4GB or more on a...

Security Bulletin: Vulnerability in bind (CVE-2021-25215) affects Power HMC

Summary BIND is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-25215 DESCRIPTION: ISC BIND is vulnerable to a denial of service, caused by an assertion failure while answering queries for DNAME records. By sending a query...

IBM AIX Information Disclosure Vulnerability (CNVD-2021-91419)

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. IBM AIX has an information disclosure vulnerability that stems from a problem with IBM AIX's handling of user privileges, which can be exploited by a non-privileged local attacker to gain...

Security Bulletin: Vulnerability in libssh affects Power Hardware Management Console (CVE-2020-1730).

Summary libssh is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2020-1730 DESCRIPTION: libssh is vulnerable to a denial of service, caused by the use of uninitialized AES-CTR ciphers. A remote attacker could exploit this...

IBM AIX 信息泄露漏洞

IBM AIX is an open standards-based UNIX operating system developed by IBM for the IBM Power architecture. An information disclosure vulnerability exists in IBM AIX, which can be exploited by attackers to obtain sensitive information...

CVE-2021-36305

Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. An authenticated user of SMB on a cluster with CA could potentially exploit this vulnerability, leading to a denial of service over SMB...