Security Bulletin: This Power System update is being released to address CVE-2022-4450

Summary This affects the BMC administrator function to upload HTTPS certificates. Vulnerability Details CVEID:CVE-2022-4450 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a double-free error related to the improper handling of specific PEM data by the PEMreadbioex function. ...

UBUNTU-CVE-2024-26646

In the Linux kernel, the following vulnerability has been resolved: thermal: intel: hfi: Add syscore callbacks for system-wide PM The kernel allocates a memory buffer and provides its location to the hardware, which uses it to update the HFI table. This allocation occurs during boot and remains...

Elspec G5 digital fault recorder security vulnerability

Elspec G5 digital fault recorder is a digital fault recorder from Elspec, Israel, used to monitor and record fault events and waveform data in power systems. A security vulnerability exists in Elspec G5 digital fault recorder version 1.1.4.15 and prior versions, which originates from allowing an...

Ecodial Deserialization RCE

The vulnerability of software for designing electrical power networks, calculating network electrical parameters, and selecting equipment for EcoStruxure Power Design/Ecodial formerly Ecodial stems from deficiencies in the deserialization mechanism during file loading. Exploiting this vulnerabili...

Moderate: Red Hat Bug Fix Advisory: fence-agents update

An update for fence-agents is now available for Red Hat Enterprise Linux 8. The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster...

Moderate: Red Hat Bug Fix Advisory: fence-agents update

An update for fence-agents is now available for Red Hat Enterprise Linux 8.4 Advanced Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service. The fence-agents packages provide a collection of scripts for...

Schneider Electric EcoStruxure Power Design Code Issue Vulnerability

Schneider Electric EcoStruxure Power Design is an electrical system design software from Schneider Electric France designed to help engineers and designers with comprehensive support and solutions when planning and designing power systems. A code issue vulnerability exists in Schneider Electric...

IBM i Permission License and Access Control Issues Vulnerabilities

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. A privilege permission and access control issue vulnerability exists in IBM i versions 7.2 through 7.5, which stems from the fact that the infrastructure may allow a...

Schneider Electric Easergy T200 Cross-Site Scripting Vulnerability

Schneider Electric Easergy T200 is an intelligent digital protection terminal from Schneider Electric France. It is mainly used for protection and control in power systems, helping to monitor and protect power equipment from faults and abnormal operations, thus ensuring the stable operation of th...

Virtuozzo Hybrid Server 7.5 Update 6 Hotfix 1 (7.5.6-112)

The Hotfix 1 for Virtuozzo Hybrid Server 7.5 Update 6 introduces a new feature and provides stability and usability bug fixes. Vulnerability id: PSBM-154494 Virtuozzo Automator Agent could fail to return disk statistics for some stopped containers. Vulnerability id: PSBM-154488 Downloading the...

Vulnerability fixed in Schneider Electric EcoStruxure Power Design

Schneider Electric has fixed a vulnerability in EcoStruxure Power Design. A malicious party could exploit the vulnerability to execute arbitrary code with privileges of the Power Design user. Successful exploitation requires the malicious party to trick the victim into opening and executing a rog...

IBM i Permission Licensing and Access Control Vulnerabilities

IBM i is a suite of operating systems from International Business Machines IBM running in IBM Power Systems and IBM PureSystems. A privilege permission and access control issue vulnerability exists in IBM i versions 7.2 through 7.5, which stems from the fact that the infrastructure may allow a...

SUSE CVE-2023-52498

In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because asyncscheduledev executes its argument function synchronously if it...

Siemens SENTRON 3KC ATC6 Ethernet Module Hidden Function Vulnerability

The Siemens SENTRON 3KC ATC6 Expansion Module is a power distribution protection device from Siemens, Germany, for monitoring and protecting power systems. A hidden function vulnerability exists in the Siemens SENTRON 3KC ATC6 Ethernet Module due to affected devices exposing unused and unstable...

ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions

ASA-2024-006: ValidateVoteExtensions helper function may allow incorrect voting power assumptions Component: Cosmos SDK Criticality: High Affected Versions: Cosmos SDK versions = 0.50.4, on 0.50 branches Affected Users: Chain developers, Validator and Node operators Impact: Elevation of Privilege...

GHSA-95RX-M9M5-M94V ASA-2024-006: ValidateVoteExtensions helper function in Cosmos SDK may allow incorrect voting power assumptions

ASA-2024-006: ValidateVoteExtensions helper function may allow incorrect voting power assumptions Component: Cosmos SDK Criticality: High Affected Versions: Cosmos SDK versions = 0.50.4, on 0.50 branches Affected Users: Chain developers, Validator and Node operators Impact: Elevation of Privilege...

Security Bulletin: Vulnerabilities in IBM Java SDK (CVE-2023-22081, CVE-2023-22067, CVE-2023-5676) affect Power HMC

Summary IBM Java SDK is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE component could allow a remote attacker to cause no confidentiality...

Schneider Electric EcoStruxure Power Design

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low Attack Complexity Vendor : Schneider Electric Equipment : EcoStruxure Power Design Vulnerability : Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability may allow for arbitrary code execution...

PT-2024-2220 · Schneider Electric · Ecostruxure Power Design - Ecodial

Name of the Vulnerable Software and Affected Versions: EcoStruxure Power Design - Ecodial affected versions not specified Description: A Deserialization of Untrusted Data issue exists, potentially allowing remote code execution when a malicious project file is loaded into the application by a val...

PT-2024-21610

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a mutual dependency between mt8183-mfgcfg and genpd during the probing stage, leading to a deadlock. The deadlock occurs in the call stack involving genpd lock an...