iLO 3 < 1.88 / iLO 4 < 2.44 XSS Vulnerability

A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session...

iLO 4 < 2.53 Remote Code Execution Vulnerability

A remote command execution vulnerability exists in Integrated Lights-Out 4 iLO 4 due to a buffer overflow in the server's http connection handling code. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. C Tenable Network Security, Inc...

iLO 4 < 2.60 / iLO 5 < 1.30 Multiple Vulnerabilities

According to its version number, the remote HP Integrated Lights-Out iLO server is affected by multiple vulnerabilities: - A remote command execution vulnerability exists in HP Integrated Lights-Out iLO server due to an unspecified reason. An unauthenticated, remote attacker can exploit this to...

HPESBHF03907 rev.1 - HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers, Remote Cross-Site Scripting in HPE iLO 5 Web User Interface

Potential Security Impact: Remote: Cross-Site Scripting XSS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers Prior to v1.40 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2018-7117 |...

Security Bulletin: Vulnerability in RC4 stream cipher affects Integrated Management Module 2 (IMM2) (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Integrated Management Module 2 IMM2. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Integrated Management Module 2 IMM2. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in...

Security Bulletin: Multiple vulnerabilities in Open SSL, OpenSSH and curl affect the Integrated Management Module II (IMM2)

Summary OpenSSL vulnerabilities were disclosed in August 2014. This bulletin also addresses curl vulnerabilities disclosed in July 2014, and OpenSSH vulnerabilities that were disclosed in April 2014. Vulnerability Details Summary OpenSSL vulnerabilities were disclosed in August 2014. This bulleti...

Security Bulletin: Vulnerabilities in OpenSSL affect System x Integrated Management Module (IMM) (CVE-2015-0204, CVE-2014-3570, CVE-2014-3572, CVE-2014-8275)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by System x Integrated Management Module IMM. IMM has addressed the applicable CVEs...

Security Bulletin: Vulnerabilities in OpenSSL affect System x Integrated Management Module (IMM) (CVE-2015-0204)

Summary OpenSSL vulnerabilities were disclosed on January 8, 2015 by the OpenSSL Project. This includes "FREAK: Factoring Attack on RSA-EXPORT keys" TLS/SSL client and server vulnerability. OpenSSL is used by System x Integrated Management Module IMM. IMM hasaddressed the applicable CVEs...

CVE-2019-1656

A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to access the shell of the underlying Linux operating system on the affected device. The vulnerability is due to improper input validation in the affected software. An...

Phishing Campaign Toolkit: King Phisher

King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. It features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness...

Multiple Siemens Products Heap Buffer Overflow Vulnerability

Siemens SINUMERIK 808D and so on are the German Siemens Siemens company's CNC machine tool system controller. A heap buffer overflow vulnerability exists in the Siemens SINUMERIK CNC Controller. A remote attacker could exploit this vulnerability by sending a specially crafted network request to...

Directory traversal

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...

Securing Smart Manufacturing with Connected Threat Defense

By David Tay, the CIO of Beyonics You’d be hard pushed to find any organization today not involved in digital transformation projects. But the manufacturing sector was arguably one of the first to the game. Back in 2011, the German government first coined the term Industry 4.0 to describe the...

Intel Integrated Performance Primitives Data Disclosure Vulnerability

Intel Integrated Performance Primitives IPP is a suite of programming tools for working with images, signal processing, and data from Intel Corporation USA. A security vulnerability exists in the password inventory in versions prior to Intel IPP 2019 update1. A local attacker can exploit the...

Kicking off the Microsoft Graph Security Hackathon

Cybersecurity is one of the hottest sectors in tech with Gartner forecasting worldwide information spending to exceed $124 billion by the end of 2019. New startups and security solutions are coming onto the market while attackers continue to find new ways to breach systems. The security solutions...

Design/Logic Flaw

The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware updates as follows. The HPE Windows firmware installer was updated in the system ROM updates which...

Security feature bypass

A security vulnerability in HPE Integrated Lights-Out 5 iLO 5 prior to v1.37 could be locally exploited to bypass the security restrictions for firmware updates...

CVE-2018-7113

A security vulnerability in HPE Integrated Lights-Out 5 iLO 5 prior to v1.37 could be locally exploited to bypass the security restrictions for firmware updates...

CVE-2018-7113

A security vulnerability in HPE Integrated Lights-Out 5 iLO 5 prior to v1.37 could be locally exploited to bypass the security restrictions for firmware updates...

CVE-2018-7113

CVE-2018-7113 affects HP’s Integrated Lights-Out 5 (iLO 5) prior to v1.37. The issue allows local attack to bypass firmware-update security restrictions, enabling unauthorized firmware updates. Affected component: iLO 5 firmware management; root cause: local bypass of update restrictions; impact:...