Security Bulletin: IBM QRadar Network Security is affected by Vulnerability in OpenSSH. (CVE-2021-41617)

Summary IBM QRadar Network Security has addressed vulnerability in OpenSSH. The issue could allow a local attacker to gain elevated privileges on the system. Vulnerability Details CVEID:CVE-2021-41617 DESCRIPTION: OpenSSH could allow a local attacker to gain elevated privileges on the system,...

HPESBST04300 rev.1 - Certain HPE SimpliVity Servers Using Intel Xeon Processors, INTEL-SA-00616, 2022.1 IPU - Intel Xeon Advisory, Multiple Local Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE SimpliVity 170r Gen10 Server - Prior to 2.6605172022 - Use BIOS family U38 HPE SimpliVity 190r Gen10 Server - Prior to 2.6605172022 - Use BIOS...

HPESBST04298 rev.1 - Certain HPE SimpliVity Servers using Certain Intel Processor BIOS, INTEL-SA-00601, 2022.1 IPU – Intel BIOS Advisory, Multiple Local Vulnerabilities

Potential Security Impact: Local: Disclosure of Information, Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE SimpliVity 170r Gen10 Server - Prior to 2.6605172022 - Use BIOS family U38 HPE SimpliVity 190r Gen10 Server - Prior to 2.6605172022 - Use BIOS...

Hardcoded credentials

Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware...

AutomationDirect DirectLOGIC with Serial Communication

1. EXECUTIVE SUMMARY CVSS v3 7.7 ATTENTION: Low attack complexity Vendor: AutomationDirect Equipment: DirectLOGIC with Serial Communication Vulnerability: Cleartext Transmission of Sensitive Information 2. UPDATE OR REPOSTED INFORMATION This updated advisory is a follow-up to the original...

Mitsubishi Electric MELSEC iQ-R, Q, L Series and MELIPC Series (Update C)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION : Exploitable remotely/low attack complexity Vendor : Mitsubishi Electric Equipment : MELSEC iQ-R, Q, and L Series CPU Module; MELIPC Series CPU Vulnerability : Improper Resource Locking 2. RISK EVALUATION Successful exploitation of this vulnerability...

Researchers Disclose Critical Flaws in Industrial Access Controllers from HID Mercury

As many as four zero-day security vulnerabilities have been disclosed in the HID Mercury access controller system that's used widely in healthcare, education, transportation, and government facilities. "The vulnerabilities uncovered allowed us to demonstrate the ability to remotely unlock and loc...

PT-2022-2878 · Moxa · Moxa Nport 5110

Name of the Vulnerable Software and Affected Versions: Moxa NPort 5110 version 2.10 Description: The issue is related to an out-of-bounds write vulnerability in the Moxa NPort 5110 asynchronous server. This vulnerability can be exploited by a remote attacker to cause the device to become...

Security Bulletin: NVIDIA DGX A100 Firmware - June 2022

NVIDIA has released a security update for NVIDIA DGX A100 firmware. This update addresses issues that may lead to information disclosure, denial of service, or escalation of privileges. To protect your system, download and install this firmware update through the NVIDIA Enterprise Support Portal...

SUSE-SU-2022:1923-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update to version 20220411 git commit f219d616f42b, bsc1199459: - CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26350, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342,...

SUSE-SU-2022:1847-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode and SEV firmware - CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,...

SUSE-SU-2022:1846-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode and SEV firmware - CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,...

SUSE-SU-2022:1840-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode and SEV firmware - CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,...

SUSE-SU-2022:1751-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update AMD ucode and SEV firmware - CVE-2021-26339, CVE-2021-26373, CVE-2021-26347, CVE-2021-26376, CVE-2021-26375, CVE-2021-26378, CVE-2021-26372, CVE-2021-26339, CVE-2021-26348, CVE-2021-26342, CVE-2021-26388, CVE-2021-26349,...

Security Bulletin: Avoiding Weak SSL/TLS Encryption in IBM System x and Flex Systems (CVE-2013-4030)

Summary Encryption with symmetric keys shorter than 128 bits is considered more vulnerable to attack than encryption with keys 128 bits or longer. Several SSL/TLS cipher suites include encryption with keys shorter than 128 bits. Vulnerability Details Abstract Encryption with symmetric keys shorte...

InHand Networks InRouter302 Firmware Update Vulnerability

InHand Networks InRouter Series is a series of routers from InHand Networks, U.S.A. A firmware update vulnerability exists in the InHand Networks InRouter302 V3.5.37 release, which stems from a lack of valid validation in the iburn firmware checking feature. An attacker could exploit this...

CVE-2022-26510

A firmware update vulnerability exists in the iburn firmware checks functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted HTTP request can lead to firmware update. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2022-26510

A firmware update vulnerability exists in the iburn firmware checks functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted HTTP request can lead to firmware update. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2022-26510

CVE-2022-26510 affects InHand Networks InRouter302 (V3.5.37). TALOS details a firmware-update vulnerability in the iburn upgrade flow: the upgrade.cgi API allows firmware updates without cryptographic signature verification; only a CRC32 check is performed, enabling an attacker to inject a backdo...

Command injection vulnerability in QNAP VioStar series NVR

Overview VioStar series NVR provided by QNAP Systems, Inc. contains a command injection vulnerability CVE-2022-27588, CWE-77. Chuya Hayakawa of 00One, Inc. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact An arbitrary command may be executed by a remote...