CVE-2022-21499

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7...

CVE-2022-22309

Summary: CVE-2022-22309 affects IBM POWER systems, where the firmware service processor (FSP) is vulnerable to unauthenticated logins via the physical serial port/TTY interface. Root cause/impact: Unauthenticated access could allow login through the serial interface, with CVSS v3.1/3.0 vectors in...

CVE-2022-29223 Buffer overflow on HUB descriptor in Azure RTOS USBX

Azure RTOS USBX is a USB host, device, and on-the-go OTG embedded stack. In versions prior to 6.1.10, an attacker can cause a buffer overflow by providing the Azure RTOS USBX host stack a HUB descriptor with bNbPorts set to a value greater than UXMAXTT which defaults to 8. For a bNbPorts value of...

IBM Power System 访问控制错误漏洞

The IBM Power System is a Power processor-based server computer from IBM in the United States. A security vulnerability exists in the IBM Power System that originates from the FSP being susceptible to unauthenticated logins via the serial port/TTY interface. The following products and versions ar...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2022-9423)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9423 advisory. 4.14.35-2047.513.2.2 - debug: Lock down kgdb Stephen Brennan Orabug: 34152700 CVE-2022-21499 Tenable has extracted the preceding description block directly from...

PT-2022-4133 · Linux +9 · Linux Kernel +9

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the insecure management of privileges when loading the KGDB and KDB debugging tools in Linux kernel's Lockdown Mode. This could allow an attacker to bypass...

Security Bulletin: This Power System update is being released to address CVE 2022-22309

Summary POWER8/POWER9: The POWER systems FSP is vulnerable to unauthenticated logins through the physical serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. In response to this security issue, a new Power System firmware...

CVE-2022-22309

The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. IBM X-Force ID: 217095...

CVE-2022-27242

A vulnerability has been identified in OpenV2G V0.9.4. The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial numbers. Thus, an attacker could introduce a buffer overflow that leads to memory corruption...

CVE-2022-27242

A vulnerability has been identified in OpenV2G V0.9.4. The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial numbers. Thus, an attacker could introduce a buffer overflow that leads to memory corruption...

Lenovo Personal Cloud Storage Trust Management Issue Vulnerability (CNVD-2022-59193)

Lenovo Personal Cloud Storage is a cloud storage platform from Lenovo, a Chinese company. Lenovo Personal Cloud Storage is vulnerable to a trust management issue that stems from a weak default password for the serial port in the device, which could be exploited by an attacker to gain physical...

Lenovo Personal Cloud Storage Trust Management Issue Vulnerability

Lenovo Personal Cloud Storage Lenovo Personal Cloud Storage is a personal cloud storage from Lenovo China.Lenovo Personal Cloud Storage is vulnerable to a trust management issue, which stems from a weak default administrator password for the web interface and serial port, which could be exploited...

Mitsubishi Electric MELSEC iQ-F Series

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: MELSEC iQ-F Series Vulnerabilities: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-22-139-01...

CVE-2021-42850

A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access...

CVE-2021-42849

A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access...

CVE-2021-42850

A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access...

CVE-2021-42849

A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access...

Lenovo Personal Cloud Storage 信任管理问题漏洞

Lenovo Personal Cloud Storage Lenovo Personal Cloud Storage is a personal cloud storage from Lenovo China.Lenovo Personal Cloud Storage is vulnerable to a trust management issue, which stems from a weak default administrator password for the web interface and serial port, which could be exploited...

Lenovo Personal Cloud Storage 授权问题漏洞

Lenovo Personal Cloud Storage is a cloud storage platform from Lenovo, a Chinese company. Lenovo Personal Cloud Storage is vulnerable to a trust management issue that stems from a weak default password for the serial port in the device, which could be exploited by an attacker to gain physical...

PT-2022-11704 · Lenovo · Lenovo Personal Cloud Storage

Name of the Vulnerable Software and Affected Versions: Lenovo Personal Cloud Storage devices affected versions not specified Description: A weak default password for the serial port was reported, which could allow unauthorized device access to an attacker with physical access. Recommendations: At...