Intel Converged Security Management Engine (CSME) Active Management Technology (AMT) Multiple Vulnerabilities (INTEL-SA-00391)

Binary data wmiINTEL-SA-00391.nbin...

CVE-2020-8761

Inadequate encryption strength in subsystem for IntelR CSME versions before 13.0.40 and 13.30.10 may allow an unauthenticated user to potentially enable information disclosure via physical access...

CVE-2020-8755

Race condition in subsystem for IntelR CSME versions before 12.0.70 and 14.0.45, IntelR SPS versions before E504.01.04.400 and E305.01.04.200 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

CVE-2020-8744

Improper initialization in subsystem for IntelR CSME versions before12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, IntelR TXE versions before 4.0.30 IntelR SPS versions before E305.01.04.200 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2020-8752

Out-of-bounds write in IPv6 subsystem for IntelR AMT, IntelR ISM versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 14.0.45 may allow an unauthenticated user to potentially enable escalation of privileges via network access...

CVE-2020-8705

Insecure default initialization of resource in IntelR Boot Guard in IntelR CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, IntelR TXE versions before 3.1.80 and 4.0.30, IntelR SPS versions before E504.01.04.400, E304.01.04.200, SoC-X04.00.04.200...

CVE-2020-12297

Improper access control in Installer for IntelR CSME Driver for Windows versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel TXE 3.1.80, 4.0.30 may allow an authenticated user to potentially enable escalation of privileges via local access...

CVE-2020-12303

Use after free in DAL subsystem for IntelR CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, IntelR TXE 3.1.80, 4.0.30 may allow an authenticated user to potentially enable escalation of privileges via local access...

Cisco NX-OS Software Data Management Engine Remote Code Execution (cisco-sa-nxos-dme-rce-cbE3nhZS)

According to its self-reported version, Cisco NX-OS Software is affected by a remote code execution vulnerability. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent...

CVE-2020-3415

A vulnerability in the Data Management Engine DME of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input...

Input validation

A vulnerability in the Data Management Engine DME of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input...

Critical: Red Hat Security Advisory: CloudForms 4.7.16 security, bug fix and enhancement update

An update is now available for CloudForms Management Engine 5.10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2020-3415 Cisco NX-OS Software Data Management Engine Remote Code Execution Vulnerability

A vulnerability in the Data Management Engine DME of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input...

CVE-2020-3415 Cisco NX-OS Software Data Management Engine Remote Code Execution Vulnerability

A vulnerability in the Data Management Engine DME of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service DoS condition on an affected device. The vulnerability is due to insufficient input...

Cisco NX-OS Remote Code Execution Vulnerability

Cisco NX-OS is the network operating system for the Cisco Nexus family of Ethernet switches and the MDS family of Fibre Channel storage area network switches. A remote code execution vulnerability exists in the Data Management Engine DME of Cisco NX-OS. The vulnerability stems from insufficient...

RHEL 7 : CloudForms 4.7.16 (RHSA-2020:3574)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3574 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual...

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, stems from insufficient validation of input data. This vulnerability allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to compromise the confidentiality and integrity of the protected...

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, stems from insufficient validation of incoming requests. This allows attackers to scan the internal network.

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, is related to insufficient checking of incoming requests. Exploiting this vulnerability allows a malicious actor to remotely scan the internal network...

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, arises from the lack of measures taken to eliminate special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary commands.

The software platform for managing virtual environments, CloudForms Management Engine, is vulnerable due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotel...

The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, relates to authentication errors. This vulnerability allows an attacker to create existing or new users for access control based on roles and groups.

The vulnerability of the CloudForms Management Engine software platform for managing virtual environments is related to authentication errors. Exploiting this vulnerability allows a malicious actor to create existing or new users for access control based on roles and groups...