Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware

Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware. IBM Flex System EN6131 40Gb Ethernet / IB6131 40Gb Infiniband Switch Firmware has addressed the...

Security Bulletin: IBM has released Unified Extensible Firmware Interface (UEFI) fixes in response to Spectre variants 4 and 3a (CVE-2018-3639 CVE-2018-3640)

Summary IBM has released the following Unified Extensible Firmware Interface UEFI fixes for System x, Flex and BladeCenter systems in response to the vulnerabilities referred to as Spectre variants 4 and 3a. Vulnerability Details CVEID: CVE-2018-3639 DESCRIPTION: Multiple Intel CPU''s could allow...

Security Bulletin: IBM Flex System switch firmware products are affected by vulnerabilities in libxml2

Summary Vulnerabilities in libxml2 have been addressed by IBM Flex System switch firmware products listed below. Vulnerability Details CVEID: CVE-2017-5130 DESCRIPTION: Google Chrome is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by libxml2. By persuading a vict...

The vulnerability of the account_print.cgi component in the microprogramming software for Zyxel USG FLEX and VPN devices allows a hacker to execute arbitrary commands.

The vulnerability of the accountprint.cgi component in the Zyxel USG FLEX and VPN network devices is related to an incorrect limitation on the path name to the tmp directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the fbwifi_forward.cgi component of the Zyxel USG FLEX, USG FLEX 50(W), USG20(W)-VPN, and VPN network devices allows a hacker to cause service interruptions.

The vulnerability of the fbwififorward.cgi component of the Zyxel USG FLEX, USG FLEX 50W, USG20W-VPN, and VPN networking devices is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions b...

The vulnerability of the command-line interface (CLI) of microprogramming software for network devices such as ZyXEL VPN, USG FLEX, and ATP allows a intruder to gain unauthorized access to protected information.

The vulnerability of the command-line interface CLI of microprogrammed network devices such as ZyXEL VPN, USG FLEX, and ATP is related to deficiencies in access control. Exploiting this vulnerability can allow an intruder to gain unauthorized access to protected information...

The vulnerability of the microprogrammed software of ZyXEL USG FLEX and ATP devices, related to the operation of writing data beyond the buffer in memory, allows a intruder to cause service failure.

The vulnerability of the microprogrammed network device software of ZyXEL USG FLEX and ATP lies in the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure by executing certain commands...

The vulnerability of the Wi-Fi hotspot implementation of the microprogramming software for network devices ZyXEL USG FLEX and VPN allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Wi-Fi hotspot technology implemented in ZyXEL USG FLEX and VPN network devices is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

The vulnerability of the microprogrammed software of ZyXEL VPN, USG FLEX, and ATP lies in the fact that operation outputs go beyond the buffer in memory, allowing a intruder to cause a service failure.

The vulnerability of the microprogrammed network devices ZyXEL VPN, USG FLEX, and ATP lies in the fact that the operation values escape outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure by executing a command to flush system logs...

flex-rock.com Improper Access Control vulnerability OBB-3799292

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-8707 · Zyxel · Zyxel Usg Flex Series +1

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.37 Patch 1 Zyxel USG FLEX series versions 4.50 through 5.37 Patch 1 Description: A null pointer dereference issue in the Anti-Malware feature of Zyxel ATP and USG FLEX series firmware could allow a...

PT-2023-8709 · Zyxel · Zyxel Usg Flex Series +3

Name of the Vulnerable Software and Affected Versions: Zyxel ATP series versions 4.32 through 5.37 Patch 1 Zyxel USG FLEX series versions 4.50 through 5.37 Patch 1 Zyxel USG FLEX 50W series versions 4.16 through 5.37 Patch 1 Zyxel USG20W-VPN series versions 4.16 through 5.37 Patch 1 Zyxel USG FLE...

CVE-2023-5960

An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access the system files on an affected device...

CVE-2023-5797

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37,...

CVE-2023-5797

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37,...

CVE-2023-5960

An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access the system files on an affected device...

Privilege escalation

An improper privilege management vulnerability in the hotspot feature of the Zyxel USG FLEX series firmware versions 4.50 through 5.37 and VPN series firmware versions 4.30 through 5.37 could allow an authenticated local attacker to access the system files on an affected device...

Privilege escalation

An improper privilege management vulnerability in the debug CLI command of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37,...

CVE-2023-4398

An integer overflow vulnerability in the source code of the QuickSec IPSec toolkit used in the VPN feature of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series...

CVE-2023-5650

An improper privilege management vulnerability in the ZySH of the Zyxel ATP series firmware versions 4.32 through 5.37, USG FLEX series firmware versions 4.50 through 5.37, USG FLEX 50W series firmware versions 4.16 through 5.37, USG20W-VPN series firmware versions 4.16 through 5.37, and VPN seri...