CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-29215
https://notcve.org/view.php?id=CVE-2021-29215
A potential security vulnerability in HPE Ezmeral Data Fabric that may allow a remote access restriction bypass in the TEZ MapR ecosystem component was discovered in version(s): Prior to Tez-0.8: mapr-tez-0.8.201907081100-1.noarch; prior to Tez-0.9: mapr-tez-0.9.201907090334-1.noarch; prior to Tez-0.9.2: mapr-tez-0.9.2.0.201907081043-1.noarch. HPE has provided software updates to resolve the vulnerability in the TEZ MapR ecosystem component in HPE Ezmeral Data Fabric. Se ha detectado una posible vulnerabilidad de seguridad en HPE Ezmeral Data Fabric que puede permitir una omisión de restricción de acceso remoto en el componente del ecosistema TEZ MapR en las versiones Anteriores a Tez-0.8: mapr-tez-0.8.201907081100-1.noarch; anteriores a Tez-0.9: mapr-tez-0.9.201907090334-1.noarch; anteriores a Tez-0.9.2: mapr-tez-0.9.2.0.201907081043-1.noarch. HPE ha proporcionado actualizaciones de software para resolver la vulnerabilidad en el componente del ecosistema TEZ MapR en HPE Ezmeral Data Fabric • https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbez04196en_us •
CVSS: 7.5EPSS: 1%CPEs: 60EXPL: 1CVE-2002-20001
https://notcve.org/view.php?id=CVE-2002-20001
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE. El Protocolo de Acuerdo de Claves Diffie-Hellman permite a atacantes remotos (del lado del cliente) enviar números arbitrarios que en realidad no son claves públicas, y desencadenar costosos cálculos de exponenciación modular DHE del lado del servidor, también se conoce como un ataque D(HE)ater. • https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf https://dheatattack.com https://dheatattack.gitlab.io https://github.com/Balasys/dheater https://github.com/mozilla/ssl-config-generator/issues/162 https://gitlab.com/dheatattack/dheater https://ieeexplore.ieee.org/document/10374117 https://support.f5.com/csp/article/K83120834 https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration https: • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2021-29213
https://notcve.org/view.php?id=CVE-2021-29213
A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, and HPE ProLiant MicroServer Gen10 Plus server's system ROMs prior to version 2.52. The vulnerability could be locally exploited to cause disclosure of sensitive information, denial of service (DoS), and/or compromise system integrity. Se ha identificado una posible vulnerabilidad de evasión local de las restricciones de seguridad en HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, and HPE ProLiant MicroServer Gen10 Plus server's system ROMs versiones anteriores a 2.52. La vulnerabilidad podría ser explotada localmente para causar una divulgación de información confidencial, la denegación de servicio (DoS), y/o comprometer la integridad del sistema • https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04197en_us •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2021-26589
https://notcve.org/view.php?id=CVE-2021-26589
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE Superdome Flex Servers. Se ha identificado una posible vulnerabilidad de seguridad en los servidores HPE Superdome Flex. La vulnerabilidad podría ser explotada remotamente para permitir un ataque de tipo Cross Site Scripting (XSS) porque la Cookie de Sesión carece de un Atributo HttpOnly. • https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04199en_us • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 10.0EPSS: 0%CPEs: 22EXPL: 0CVE-2021-26588
https://notcve.org/view.php?id=CVE-2021-26588
A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the confidentiality, integrity, availability of the array. HPE has made the following software updates and mitigation information to resolve the vulnerability in 3PAR, Primera and Alletra 9000 firmware. Se ha identificado una posible vulnerabilidad de seguridad en el firmware de HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array. • https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04191en_us •