CVSS: 6.1EPSS: 0%CPEs: 11EXPL: 0CVE-2014-0883 – IBM Power Hardware Management Console cross-site scripting
https://notcve.org/view.php?id=CVE-2014-0883
IBM Power HMC 7.1.0 through 7.8.0 and 7.3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 91163. Vulnerabilidad de Cross-Site Scripting (XSS) en IBM Power Hardware Management Console (HMC) 7R7.1.0, 7R7.2.0, 7R7.3.0 hasta 7R7.3.5, 7R7.7.0 hasta SP3 y 7R7.8.0 anterior al SP1 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el nombre de usuario en la pantalla de inicio de sesión. IBM X-Force ID: 91163. • https://exchange.xforce.ibmcloud.com/vulnerabilities/91163 https://www.ibm.com/support/pages/security-bulletin-power-hardware-management-console-hmc-cve-2014-0883 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-1134
https://notcve.org/view.php?id=CVE-2017-1134
IBM Reliable Scalable Cluster Technology could allow a local user to escalate their privileges to gain root access. IBM Reference #: 1998459. IBM Reliable Scalable Cluster Technology podría permitir a un usuario local escalar sus privilegios para obtener acceso de root. Referencia IBM: 1998459. • http://www.ibm.com/support/docview.wss?uid=swg21998459 http://www.securityfocus.com/bid/96764 http://www.securitytracker.com/id/1038389 •
CVSS: 4.9EPSS: 0%CPEs: 19EXPL: 0CVE-2016-5011 – util-linux: Extended partition loop in MBR partition table leads to DOS
https://notcve.org/view.php?id=CVE-2016-5011
The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset. La función parse_dos_extended en partitions/dos.c en la biblioteca libblkid en util-linux permite a atacantes físicamente próximos provocar una denegación de servicio (consumo de memoria) a través de una tabla de particiones MSDOS manipulada con un registro de arranque de partición extendida en desplazamiento cero. It was found that util-linux's libblkid library did not properly handle Extended Boot Record (EBR) partitions when reading MS-DOS partition tables. An attacker with physical USB access to a protected machine could insert a storage device with a specially crafted partition table that could, for example, trigger an infinite loop in systemd-udevd, resulting in a denial of service on that machine. • http://rhn.redhat.com/errata/RHSA-2016-2605.html http://www-01.ibm.com/support/docview.wss?uid=isg3T1024543 http://www-01.ibm.com/support/docview.wss?uid=nas8N1021801 http://www.openwall.com/lists/oss-security/2016/07/11/2 http://www.securityfocus.com/bid/91683 http://www.securitytracker.com/id/1036272 https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/commit/?id=7164a1c3 https://access.redhat.com/security/cve/CVE-2016-5011 https://bugzilla.redhat. •
CVSS: 7.2EPSS: 0%CPEs: 22EXPL: 0CVE-2016-0230
https://notcve.org/view.php?id=CVE-2016-0230
IBM Power Hardware Management Console (HMC) 7.3 through 7.3.0 SP7, 7.9 through 7.9.0 SP3, 8.1 through 8.1.0 SP3, 8.2 through 8.2.0 SP2, 8.3 through 8.3.0 SP2, 8.4 through 8.4.0 SP1, and 8.5.0 allows physically proximate attackers to obtain root access via unspecified vectors. IBM Power Hardware Management Console (HMC) 7.3 hasta la versión 7.3.0 SP7, 7.9 hasta la versión 7.9.0 SP3, 8.1 hasta la versión 8.1.0 SP3, 8.2 hasta la versión 8.2.0 SP2, 8.3 hasta la versión 8.3.0 SP2, 8.4 hasta la versión 8.4.0 SP1 y 8.5.0 permite a atacantes físicamente próximos obtener acceso de root a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=nas8N1021387 http://www-01.ibm.com/support/docview.wss?uid=swg1MB04021 http://www-01.ibm.com/support/docview.wss?uid=swg1MB04022 http://www-01.ibm.com/support/docview.wss?uid=swg1MB04023 http://www-01.ibm.com/support/docview.wss? • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 0CVE-2012-3296
https://notcve.org/view.php?id=CVE-2012-3296
Cross-site scripting (XSS) vulnerability in the Help link in the login panel in IBM Power Hardware Management Console (HMC) 7R7.1.0 before SP4, 7R7.2.0 before SP2, and 7R7.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en el enlace de Ayuda en el panel de inicio de sesión en IBM Power Hardware Management Console (HMC) v7R7.1.0 antes SP4, v7R7.2.0 antes de SP2 y 7R7.3.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados. • http://secunia.com/advisories/50376 http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_the_help_link_on_the_power_hmc_login_panel_is_susceptible_to_reflected_cross_site_scripting_cve_2012_329617 http://www.ibm.com/support/docview.wss?uid=isg1MB03488 http://www.ibm.com/support/docview.wss?uid=isg1MB03489 http://www.ibm.com/support/docview.wss?uid=isg1MB03494 http://www.ibm.com/support/fixcentral/firmware/readme?fixid=MH01253 http://www.ibm.com/support/fixcentral/firmware/readme • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •