Security Bulletin: A security vulnerability has been identified in Red Hat® Enterprise Linux (RHEL) Server shipped with PurePower Integrated Manager (PPIM)

Summary RHEL Server is shipped as a component of PPIM. Information about a security vulnerability affecting RHEL Server has been published in a Red Hat errata. Vulnerability Details Consult the Red Hat errata RHSA-2018:3221 for vulnerability details and information about fixes Affected Products a...

Security Bulletin: A security vulnerability has been identified in Red Hat® Enterprise Linux (RHEL) Server shipped with PurePower Integrated Manager (PPIM)

Summary RHEL Server is shipped as a component of PPIM. Information about a security vulnerability affecting RHEL Server has been published in a Red Hat errata. Vulnerability Details Consult the Red Hat errata RHSA-2018:3221 for vulnerability details and information about fixes Affected Products a...

iLO 2 2.29 Remote Code Execution Vulnerability

A remote command execution vulnerability exists in Integrated Lights-Out 2 iLO 2 version 2.29 due to insufficient access control. An unauthenticated, remote attacker can exploit this to bypass authentication, execute arbitrary commands or cause a denial of service. C Tenable Network Security, Inc...

When Cyberattacks Pack a Physical Punch

More than one in 10 data breaches now involve “physical actions,” according to a recent report. These include leveraging physical devices to aid an attack, but also hacks that involve breaking into hardware and remote attacks on physical infrastructure. The stat underscores the realities of a...

iLO 2 <= 2.23 Denial of Service Vulnerability

A denial of service DoS vulnerability exists in Integrated Lights-Out iLO 2 due to incorrect handling of https traffic. An unauthenticated, remote attacker can exploit this issue to cause the application to stop responding. C Tenable Network Security, Inc. include"compat.inc"; if description...

iLO 3 < 1.85 / iLO 4 < 2.22 Denial of Service Vulnerability

A denial of service DoS vulnerability exists in Integrated Lights-Out iLO due to an undisclosed vulnerability. An authenticated, remote attacker can exploit this issue to cause the application to stop responding. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid122191;...

iLO 3 < 1.88 / iLO 4 < 2.44 XSS Vulnerability

A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session...

iLO 4 < 2.53 Remote Code Execution Vulnerability

A remote command execution vulnerability exists in Integrated Lights-Out 4 iLO 4 due to a buffer overflow in the server's http connection handling code. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. C Tenable Network Security, Inc...

iLO 4 < 2.60 / iLO 5 < 1.30 Multiple Vulnerabilities

According to its version number, the remote HP Integrated Lights-Out iLO server is affected by multiple vulnerabilities: - A remote command execution vulnerability exists in HP Integrated Lights-Out iLO server due to an unspecified reason. An unauthenticated, remote attacker can exploit this to...

HPESBHF03907 rev.1 - HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers, Remote Cross-Site Scripting in HPE iLO 5 Web User Interface

Potential Security Impact: Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers Prior to v1.40 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2018-7117 |...

Security Bulletin: Vulnerability in RC4 stream cipher affects Integrated Management Module 2 (IMM2) (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Integrated Management Module 2 IMM2. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Integrated Management Module 2 IMM2. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in...

Security Bulletin: Vulnerabilities in OpenSSL affect System x Integrated Management Module (IMM) (CVE-2015-0204, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by System x Integrated Management Module IMM. IMM has addressed the applicable CVEs...

Security Bulletin: Multiple vulnerabilities in Open SSL, OpenSSH and curl affect the Integrated Management Module II (IMM2)

Summary OpenSSL vulnerabilities were disclosed in August 2014. This bulletin also addresses curl vulnerabilities disclosed in July 2014, and OpenSSH vulnerabilities that were disclosed in April 2014. Vulnerability Details Summary OpenSSL vulnerabilities were disclosed in August 2014. This bulleti...

Security Bulletin: Vulnerabilities in OpenSSL affect System x Integrated Management Module (IMM) (CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by System x Integrated Management Module IMM. IMM hasaddressed the applicable CVEs...

CVE-2019-1656

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation in the affected software. An...

Phishing Campaign Toolkit: King Phisher

King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. It features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness...

Multiple Siemens Products Heap Buffer Overflow Vulnerability

Siemens SINUMERIK 808D and so on are the German Siemens Siemens company's CNC machine tool system controller. A heap buffer overflow vulnerability exists in the Siemens SINUMERIK CNC Controller. A remote attacker could exploit this vulnerability by sending a specially crafted network request to...

Directory traversal

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...

Securing Smart Manufacturing with Connected Threat Defense

By David Tay, the CIO of Beyonics You’d be hard pushed to find any organization today not involved in digital transformation projects. But the manufacturing sector was arguably one of the first to the game. Back in 2011, the German government first coined the term Industry 4.0 to describe the...

Intel Integrated Performance Primitives Data Disclosure Vulnerability

Intel Integrated Performance Primitives IPP is a suite of programming tools for working with images, signal processing, and data from Intel Corporation USA. A security vulnerability exists in the password inventory in versions prior to Intel IPP 2019 update1. A local attacker can exploit the...