CVE-2014-3093

IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in 1 api-paste.ini, 2 debug logs, 3 the installation process, 4 environment checks, 5 powervc-ldap-config, 6 powervc-restore, and 7 powervc-diag, which allows local users to obtain sensitive information by entering a ps...

CVE-2014-3093

IBM PowerVC versions 1.2.0 before FP3 and 1.2.1 before FP2 are affected. The issue involves cleartext passwords being stored/accessed in multiple locations (api-paste.ini, debug logs, installation process, environment checks, powervc-ldap-config, powervc-restore, powervc-diag), allowing local use...

CVE-2014-3093

IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in 1 api-paste.ini, 2 debug logs, 3 the installation process, 4 environment checks, 5 powervc-ldap-config, 6 powervc-restore, and 7 powervc-diag, which allows local users to obtain sensitive information by entering a ps...

Command injection

IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in 1 api-paste.ini, 2 debug logs, 3 the installation process, 4 environment checks, 5 powervc-ldap-config, 6 powervc-restore, and 7 powervc-diag, which allows local users to obtain sensitive information by entering a ps...

CVE-2014-3093: Undefined Security Weakness

IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in 1 api-paste.ini, 2 debug logs, 3 the installation process, 4 environment checks, 5 powervc-ldap-config, 6 powervc-restore, and 7 powervc-diag, which allows local users to obtain sensitive information by entering a ps...

CVE-2014-4749

IBM PowerVC 1.2.0 before FixPack3 does not properly use the knownhosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key...

CVE-2014-4750

IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials by sniffing the network...

Code injection

IBM PowerVC 1.2.0 before FixPack3 does not properly use the knownhosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key...

Code injection

IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials by sniffing the network...

CVE-2014-4750

IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials by sniffing the network...

CVE-2014-4750

CVE-2014-4750 affects IBM PowerVC Express Edition 1.2.0 before FixPack3. The issue is that an FTP session used to transfer files to a managed IVM can allow an attacker to sniff network traffic and discover credentials, impacting confidentiality. The vulnerability description indicates the root ca...

CVE-2014-4749

IBM PowerVC 1.2.0 before FixPack3 does not properly use the knownhosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key...

CVE-2014-4749

CVE-2014-4749 affects IBM PowerVC 1.2.0 prior to FixPack3. The vulnerability arises from improper handling of the known_hosts file, enabling man‑in‑the‑middle attackers to spoof SSH servers via an arbitrary server key. Impact is partial confidentiality breach (spoofed SSH keys) with network acces...

CVE-2014-4749: Undefined Security Weakness

IBM PowerVC 1.2.0 before FixPack3 does not properly use the knownhosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key...

CVE-2014-4750: Exposure of Sensitive Information to an Unauthorized Actor

IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials by sniffing the network...