Security Bulletin: Vulnerabilities in OpenSSL affect Integrated Management Module 2 (IMM2) (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by Integrated Management Module 2. Integrated Management Module 2 has addressed the applicable CVEs and included the SSL 3.0 Fallback...

Security Bulletin: Vulnerability in RC4 stream cipher affects Integrated Management Module 2 (IMM2) (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Integrated Management Module 2 IMM2. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Integrated Management Module 2 IMM2. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System FC5022 16Gb SAN Scalable Switch Firmware (CVE-2014-3513, CVE-2014-3567, CVE-2014-3568)

Summary OpenSSL vulnerabilities along with SSL 3 Fallback protection TLSFALLBACKSCSV were disclosed on October 15, 2014 by the OpenSSL Project. OpenSSL is used by IBM Flex System FC5022 16Gb SAN Scalable Switch Firmware. IBM Flex System FC5022 16G SAN Scalable Switch Firmware has addressed the...

Security Bulletin: Vulnerabilities in PHP affect IBM Chassis Management Module (CMM) (CVE-2013-4248, CVE-2013-6420, CVE-2014-2497, CVE-2014-4049)

Summary Multiple vulnerabilities in PHP affect IBM Chassis Management Module CMM. Vulnerability Details Summary Multiple vulnerabilities in PHP affect IBM Chassis Management Module CMM. Vulnerability Details: CVE-ID: CVE-2013-4248 Description: PHP could allow a remote attacker to conduct spoofing...

Security Bulletin: Vulnerability in SSLv3 affects Flex System FC3171 8Gb SAN Switch and Flex System FC3171 8Gb SAN Pass-thru (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Flex System FC3171 8Gb SAN Switch and Flex System FC3171 8Gb SAN Pass-thru. Vulnerability Details Summary SSLv3 contains a vulnerability that h...

Security Bulletin: GNU C library (glibc) vulnerability affects IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware. Vulnerability Details Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM Flex System EN6131 40G...

Security Bulletin: NeXtScale Fan Power Controller (FPC) July 2014 Fixes (CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, CVE-2014-3470)

Summary The NeXtScale Fan Power Controller FPC July 2014 firmware update contains fixes for six vulnerabilities. Vulnerability Details Abstract The NeXtScale Fan Power Controller FPC July 2014 firmware update contains fixes for six vulnerabilities. Content Vulnerability Details: CVE ID:...

Security Bulletin: Flex System Chassis Management Module (CMM) is affected by vulnerabilities in OpenSSL (CVE-2014-0160 and CVE-2014-0076)

Summary Security vulnerabilities have been discovered in OpenSSL. Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL. Content Vulnerability Details: CVE ID: CVE-2014-0160 Description: OpenSSL could allow a remote attacker to obtain sensitive information, cause...

Mitsubishi Electric MELSEC-Q Series PLCs

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Mitsubishi Electric Equipment: MELSEC-Q series PLCs Vulnerability: Resource Exhaustion 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to send...

Japanese Government Will Hack Citizens' IoT Devices

The Japanese government is going to run penetration tests against all the IoT devices in their country, in an effort to 1 figure out what's insecure, and 2 help consumers secure them: The survey is scheduled to kick off next month, when authorities plan to test the password security of over 200...

New Exploit Threatens Over 9,000 Hackable Cisco RV320/RV325 Routers Worldwide

If the connectivity and security of your organization rely on Cisco RV320 or RV325 Dual Gigabit WAN VPN routers, then you need to immediately install the latest firmware update released by the vendor last week. Cyber attackers have actively been exploiting two newly patched high-severity router...

CVE-2019-1653

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit th...

Security Bulletin: IBM Security QRadar Packet Capture is vulnerable to 3RD PARTY CPU hardware utilizing speculative execution cache timing side-channel analysis known as Variant 4 or SpectreNG (CVE-2018-3639, CVE-2018-3640)

Summary Speculative execution is a technique used by many modern processors to improve performance by predicting which instructions may be executed based on past execution history. An attacker with local user access may be able to utilize sequences of speculative execution to perform a cache timi...

Security Bulletin: TPM on the Integrated Management Module II (IMM2) of Flex System x222 compute node is not configured correctly (CVE-2014-0881)

Summary The IMM2 TPM on the Flex System x222 compute node is not configured correctly which can be exploited to steal keys or to perform 'denial of service' type attacks. Vulnerability Details Abstract The IMM2 TPM on the Flex System x222 compute node is not configured correctly which can be...

PHOENIX CONTACT FL SWITCH

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: PHOENIX CONTACT Equipment: FL SWITCH Vulnerabilities: Cross-site Request Forgery, Improper Restriction of Excessive Authentication Attempts, Cleartext Transmission of Sensitive Information, Resourc...

Cisco Small Business RV320 and RV325 Routers Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit th...

PT-2019-1227

Name of the Vulnerable Software and Affected Versions Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers affected versions not specified Description A vulnerability in the web-based management interface of the routers could allow an unauthenticated, remote attacker to retrieve...

Bitdefender BOX 2 bootstrap download_image command injection vulnerability

Summary An exploitable command injection vulnerability exists in the bootstrap stage of Bitdefender BOX 2, versions 2.1.47.42 and 2.1.53.45. The API method /api/downloadimage unsafely handles the production firmware URL supplied by remote servers, leading to arbitrary execution of system commands...

HPSBHF03601 rev. 4 - Arbitrary Code Execution via Intel Smart Sound Technologies Driver

Potential Security Impact Escalation of Privilege Source: HP, HP Product Security Response Team PSRT Reported by: Intel VULNERABILITY SUMMARY HP has been informed of potential security vulnerabilities in the Intel Smart Sound Technologies driver module prior to version 9.21.00.354. These...

ControlByWeb X-320M

1. EXECUTIVE SUMMARY CVSS v3 7.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ControlByWeb Equipment: X-320M Vulnerabilities: Improper Authentication, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow arbitrary code execution...