CVE-2021-38960

CVE-2021-38960 affects IBM OPENBMC OP920, OP930 and OP940 (and OP910 per CNVD) exposing sensitive information to unauthenticated users via the BMC HTTPS server. Root cause described as an information-disclosure vulnerability with network access and no authentication required. Impact is partial to...

IBM OPENBMC OP910 信息泄露漏洞

IBM OPENBMC OP910 is a POWER8 and POWER9 emulator from International Business Machines Corporation IBM.IBM OPENBMC OP920, OP930 and OP940 have a security vulnerability that could be exploited by an unauthenticated attacker to gain access to sensitive information...

Security Bulletin: This Power System update is being released to address CVE 2021-38960

Summary POWER9: In response to a security issue with BMC's HTTPS server, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2021-38960 Vulnerability Details CVEID: CVE-2021-38960 DESCRIPTION: IBM OPENBMC could allow an...

IBM OPENBMC Cross-Site Scripting Vulnerability

IBM OPENBMC is a POWER8 and POWER9 emulator from International Business Machines Corporation Ibm. IBM OPENBMC has a cross-site scripting vulnerability in version OP910 that stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit the vulnerability...

CVE-2021-38961

IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049...

CVE-2021-38961

IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049...

Cross site scripting

IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049...

CVE-2021-38961

CVE-2021-38961 affects IBM OPENBMC OP910 with a cross-site scripting vulnerability arising from insufficient input validation/output handling in the Web UI. Impacted component: web server/UI where malicious JavaScript could be embedded, potentially leading to credentials disclosure within a trust...

CVE-2021-38961

IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049...

Security Bulletin: This Power System update is being released to address CVE 2021-38961

Summary POWER9: In response to a security issue with the BMC's web server, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2021-38961. Vulnerability Details CVEID: CVE-2021-38961 DESCRIPTION: IBM OPENBMC is vulnerable to...

CVE-2021-38961

IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049...

Security Bulletin: Incorrect file permissions allows authenticated users to recover IPMI user passwords

Summary A flaw in the file permissions may expose IPMI user passwords. This may lead to privilege escalations. Vulnerability Details CVEID: CVE-2020-14156 DESCRIPTION: OpenBMC phosphor-host-ipmid could allow a remote authenticated attacker to bypass security restrictions, caused by the failure to...

Security Bulletin: This Power System update is being released to address CVE 2021-39296

Summary POWER9: In response to a security issue with BMC's IPMI LAN+ interface, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2021-39296. Vulnerability Details CVEID: CVE-2021-39296 DESCRIPTION: OpenBMC could allow a remote...

CVE-2021-39296

In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system...

CVE-2021-39296

In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system...

Authentication flaw

In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system...

OpenBMC 授权问题漏洞

OpenBMC is a Linux distribution for managing controllers used in devices such as servers, top-of-rack switches or RAID devices. It uses Yocto, OpenEmbedded, systemd and D-Bus to easily customize your platform. OpenBMC suffers from an authorization issue vulnerability, which originates in OpenBMC...

CVE-2021-39296

In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system...

CVE-2021-39296

CVE-2021-39296: In OpenBMC 2.9, crafted IPMI messages on the netipmid (IPMI LAN+) interface can bypass authentication and grant an attacker full control of the BMC. Intel’s advisory (INTEL-SA-00737) and related vendor bulletins confirm this issue affecting OpenBMC firmware on some Intel platforms...

PT-2021-7645 · Openbmc · Openbmc

Name of the Vulnerable Software and Affected Versions: OpenBMC version 2.9 Description: The issue is related to the netipmid interface IPMI lan+ in the OpenBMC embedded operating system, which is associated with errors during the authentication procedure. An attacker can exploit this issue by...