Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
16 vulnerabilities found for OPENBMC by IBM
CVE-2026-8058 (GCVE-0-2026-8058)
Vulnerability from nvd – Published: 2026-07-28 15:56 – Updated: 2026-07-28 15:56
VLAI
EPSS
VEX
Title
This Power System update is being released to address a sensitive information disclosure
Summary
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.
Severity
4.5 (Medium)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7280642 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | OPENBMC |
Affected:
FW1110.00 , ≤ FW1110.20
(semver)
Affected: FW1060.00 , ≤ FW1060.71 (semver) cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.20:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.20.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.71:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.71.0:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.20:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.20.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.71:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.71.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1110.20",
"status": "affected",
"version": "FW1110.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1060.71",
"status": "affected",
"version": "FW1060.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.\u003c/p\u003e"
}
],
"value": "IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:56:27.745Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7280642"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1110.30(1110_145) or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003cbr/\u003e1) IBM Power System S1122 (9824-22A)\u003cbr/\u003e2) IBM Power System S1124 (9824-42A)\u003cbr/\u003e3) IBM Power System S1122s (9824-22B)\u003cbr/\u003e4) IBM Power System S1114 (9824-41B)\u003cbr/\u003e5) IBM Power System L1122 (9856-22H)\u003cbr/\u003e6) IBM Power System L1124 (9856-42H)\u003cbr/\u003e7) IBM Power System E1150 (9043-MRU)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install 1060.72(1060_177), 1060.80(1060_185) or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003cbr/\u003e1) IBM Power System S1022 (9105-22A)\u003cbr/\u003e2) IBM Power System S1024 (9105-42A)\u003cbr/\u003e3) IBM Power System S1022s (9105-22B)\u003cbr/\u003e4) IBM Power System S1014 (9105-41B)\u003cbr/\u003e5) IBM Power System L1022 (9786-22H)\u003cbr/\u003e6) IBM Power System L1024 (9786-42H)\u003cbr/\u003e7) IBM Power System E1050 (9043-MRX)\u003cbr/\u003e8) IBM Power System S1012 (9028-21B)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central : \u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1110.30(1110_145) or newer to remediate this vulnerability.Power 111) IBM Power System S1122 (9824-22A)2) IBM Power System S1124 (9824-42A)3) IBM Power System S1122s (9824-22B)4) IBM Power System S1114 (9824-41B)5) IBM Power System L1122 (9856-22H)6) IBM Power System L1124 (9856-42H)7) IBM Power System E1150 (9043-MRU)Customers with the products below should install 1060.72(1060_177), 1060.80(1060_185) or newer to remediate this vulnerability.Power 101) IBM Power System S1022 (9105-22A)2) IBM Power System S1024 (9105-42A)3) IBM Power System S1022s (9105-22B)4) IBM Power System S1014 (9105-41B)5) IBM Power System L1022 (9786-22H)6) IBM Power System L1024 (9786-42H)7) IBM Power System E1050 (9043-MRX)8) IBM Power System S1012 (9028-21B)The images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/"
}
],
"title": "This Power System update is being released to address a sensitive information disclosure",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProtect access to the BMC\u0027s administrative functions.\u003c/p\u003e"
}
],
"value": "Protect access to the BMC\u0027s administrative functions."
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-8058",
"datePublished": "2026-07-28T15:56:27.745Z",
"dateReserved": "2026-05-06T20:45:47.792Z",
"dateUpdated": "2026-07-28T15:56:27.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7868 (GCVE-0-2026-7868)
Vulnerability from nvd – Published: 2026-07-28 15:59 – Updated: 2026-07-28 17:36
VLAI
EPSS
VEX
Title
This Power System update is being released to address incorrect authorization
Summary
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7280641 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | OPENBMC |
Affected:
FW1110.00 , ≤ FW1110.20
(semver)
Affected: FW1060.00 , ≤ FW1060.71 (semver) cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.20:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.20.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.71:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.71.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7868",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T17:35:53.287045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T17:36:01.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.20:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.20.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.71:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.71.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1110.20",
"status": "affected",
"version": "FW1110.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1060.71",
"status": "affected",
"version": "FW1060.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.\u003c/p\u003e"
}
],
"value": "IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:59:21.082Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7280641"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1110.30(1110_145) or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003cbr/\u003e1) IBM Power System S1122 (9824-22A)\u003cbr/\u003e2) IBM Power System S1124 (9824-42A)\u003cbr/\u003e3) IBM Power System S1122s (9824-22B)\u003cbr/\u003e4) IBM Power System S1114 (9824-41B)\u003cbr/\u003e5) IBM Power System L1122 (9856-22H)\u003cbr/\u003e6) IBM Power System L1124 (9856-42H)\u003cbr/\u003e7) IBM Power System E1150 (9043-MRU)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install FW1060.72(1060_177), FW1060.80(1060_185) or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003cbr/\u003e1) IBM Power System S1022 (9105-22A)\u003cbr/\u003e2) IBM Power System S1024 (9105-42A)\u003cbr/\u003e3) IBM Power System S1022s (9105-22B)\u003cbr/\u003e4) IBM Power System S1014 (9105-41B)\u003cbr/\u003e5) IBM Power System L1022 (9786-22H)\u003cbr/\u003e6) IBM Power System L1024 (9786-42H)\u003cbr/\u003e7) IBM Power System E1050 (9043-MRX)\u003cbr/\u003e8) IBM Power System S1012 (9028-21B)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central : \u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1110.30(1110_145) or newer to remediate this vulnerability.\nPower 11\n1) IBM Power System S1122 (9824-22A)\n2) IBM Power System S1124 (9824-42A)\n3) IBM Power System S1122s (9824-22B)\n4) IBM Power System S1114 (9824-41B)\n5) IBM Power System L1122 (9856-22H)\n6) IBM Power System L1124 (9856-42H)\n7) IBM Power System E1150 (9043-MRU)\n\n\n\nCustomers with the products below should install FW1060.72(1060_177), FW1060.80(1060_185) or newer to remediate this vulnerability.\nPower 10\n1) IBM Power System S1022 (9105-22A)\n2) IBM Power System S1024 (9105-42A)\n3) IBM Power System S1022s (9105-22B)\n4) IBM Power System S1014 (9105-41B)\n5) IBM Power System L1022 (9786-22H)\n6) IBM Power System L1024 (9786-42H)\n7) IBM Power System E1050 (9043-MRX)\n8) IBM Power System S1012 (9028-21B)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/"
}
],
"title": "This Power System update is being released to address incorrect authorization",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAfter applying this fix, ensure local BMC user accounts are as intended.\u00a0 You can use the BMC\u0027s ASMI web application \u0026gt; Security and access \u0026gt; User management to view BMC accounts.\u003c/p\u003e"
}
],
"value": "After applying this fix, ensure local BMC user accounts are as intended.\u00a0 You can use the BMC\u0027s ASMI web application \u003e Security and access \u003e User management to view BMC accounts."
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-7868",
"datePublished": "2026-07-28T15:59:21.082Z",
"dateReserved": "2026-05-05T14:00:11.372Z",
"dateUpdated": "2026-07-28T17:36:01.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7254 (GCVE-0-2026-7254)
Vulnerability from nvd – Published: 2026-05-27 13:12 – Updated: 2026-05-27 14:48
VLAI
EPSS
VEX
Title
Open BMC Denial of Service
Summary
IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7272993 | vendor-advisorypatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-7254",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T14:48:19.046200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T14:48:48.502Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.11:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.11.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1110.11",
"status": "affected",
"version": "FW1110.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM OPENBMC FW1110.00 through FW1110.11\u0026nbsp;\u003cspan\u003eis vulnerable to denial of service attacks by unauthenticated network users.\u003c/span\u003e\u003c/p\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "IBM OPENBMC FW1110.00 through FW1110.11\u00a0is vulnerable to denial of service attacks by unauthenticated network users."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T13:13:28.863Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7272993"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1110.20(1110_130) or newer to remediate this vulnerability.\u003cbr\u003ePower 11\u003cbr\u003e1) IBM Power System S1122 (9824-22A)\u003cbr\u003e2) IBM Power System S1124 (9824-42A)\u003cbr\u003e3) IBM Power System S1122s (9824-22B)\u003cbr\u003e4) IBM Power System S1114 (9824-41B)\u003cbr\u003e5) IBM Power System L1122 (9856-22H)\u003cbr\u003e6) IBM Power System L1124 (9856-42H)\u003cbr\u003e7) IBM Power System E1150 (9043-MRU)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central : \u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1110.20(1110_130) or newer to remediate this vulnerability.\nPower 11\n1) IBM Power System S1122 (9824-22A)\n2) IBM Power System S1124 (9824-42A)\n3) IBM Power System S1122s (9824-22B)\n4) IBM Power System S1114 (9824-41B)\n5) IBM Power System L1122 (9856-22H)\n6) IBM Power System L1124 (9856-42H)\n7) IBM Power System E1150 (9043-MRU)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/"
}
],
"title": "Open BMC Denial of Service",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProtect access to the BMC\u0027s network interface.\u003c/p\u003e"
}
],
"value": "Protect access to the BMC\u0027s network interface."
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-7254",
"datePublished": "2026-05-27T13:12:06.648Z",
"dateReserved": "2026-04-27T23:05:58.869Z",
"dateUpdated": "2026-05-27T14:48:48.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35124 (GCVE-0-2024-35124)
Vulnerability from nvd – Published: 2024-08-13 11:14 – Updated: 2024-08-13 13:07
VLAI
EPSS
VEX
Title
IBM OpenBMC authentication bypass
Summary
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7163195 | vendor-advisory |
| https://https://exchange.xforce.ibmcloud.com/vuln… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | OpenBMC |
Affected:
FW1050.00 , ≤ FW1050.10
(semver)
Affected: FW1030.00 , ≤ FW1030.50 (semver) Affected: FW1020.00 , ≤ FW1020.60 (semver) cpe:2.3:o:ibm:openbmc:FW1020.00:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1020.60:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1030.00:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1030.50:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1050.00:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1050.10:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35124",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-13T13:06:48.493514Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T13:07:10.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:ibm:openbmc:FW1020.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1020.60:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1030.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1030.50:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1050.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1050.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "OpenBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1050.10",
"status": "affected",
"version": "FW1050.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1030.50",
"status": "affected",
"version": "FW1030.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1020.60",
"status": "affected",
"version": "FW1020.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in the combination of the OpenBMC\u0027s FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674."
}
],
"value": "A vulnerability in the combination of the OpenBMC\u0027s FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T11:14:40.227Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7163195"
},
{
"tags": [
"vdb-entry"
],
"url": "https://https://exchange.xforce.ibmcloud.com/vulnerabilities/290674"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM OpenBMC authentication bypass",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-35124",
"datePublished": "2024-08-13T11:14:40.227Z",
"dateReserved": "2024-05-09T16:27:14.739Z",
"dateUpdated": "2024-08-13T13:07:10.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31916 (GCVE-0-2024-31916)
Vulnerability from nvd – Published: 2024-06-27 17:45 – Updated: 2024-08-02 01:59
VLAI
EPSS
VEX
Title
IBM OpenBMC information disclosure
Summary
IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7158679 | vendor-advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entry |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1050.00:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "openbmc",
"vendor": "ibm",
"versions": [
{
"lessThanOrEqual": "fw1050.10",
"status": "affected",
"version": "fw1050.00",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31916",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-27T19:58:11.462816Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-03T19:40:31.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:59:50.705Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7158679"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/290026"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1050.10",
"status": "affected",
"version": "FW1050.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026."
}
],
"value": "IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T17:45:31.618Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7158679"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/290026"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM OpenBMC information disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-31916",
"datePublished": "2024-06-27T17:45:31.618Z",
"dateReserved": "2024-04-07T12:45:15.767Z",
"dateUpdated": "2024-08-02T01:59:50.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-22488 (GCVE-0-2022-22488)
Vulnerability from nvd – Published: 2022-11-18 17:02 – Updated: 2025-04-28 19:07
VLAI
EPSS
VEX
Title
IBM OpenBMC denial of service
Summary
IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6840155 | vendor-advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entry |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:14:55.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6840155"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/226337"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-22488",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-28T19:06:20.249181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T19:07:40.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenBMC",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "OP910, OP940"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337."
}
],
"value": "IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6840155"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/226337"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM OpenBMC denial of service",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2022-22488",
"datePublished": "2022-11-18T17:02:01.980Z",
"dateReserved": "2022-01-03T22:29:21.008Z",
"dateUpdated": "2025-04-28T19:07:40.468Z",
"requesterUserId": "520cc88b-a1c8-44f6-9154-21a4d74c769f",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38960 (GCVE-0-2021-38960)
Vulnerability from nvd – Published: 2022-02-04 22:33 – Updated: 2024-09-16 16:27
VLAI
EPSS
VEX
Summary
IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.
Severity
CWE
- Obtain Information
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6529322 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
Date Public
2022-02-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:20.780Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6529322"
},
{
"name": "ibm-openbmc-cve202138960-info-disc (212047)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212047"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "OP920"
},
{
"status": "affected",
"version": "OP930"
},
{
"status": "affected",
"version": "OP940"
}
]
},
{
"product": "HMC",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "OP940"
}
]
}
],
"datePublic": "2022-02-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.6,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/PR:N/I:N/AC:L/S:U/A:N/UI:N/C:L/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:07.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6529322"
},
{
"name": "ibm-openbmc-cve202138960-info-disc (212047)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212047"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2022-02-02T00:00:00",
"ID": "CVE-2021-38960",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OPENBMC",
"version": {
"version_data": [
{
"version_value": "OP920"
},
{
"version_value": "OP930"
},
{
"version_value": "OP940"
}
]
}
},
{
"product_name": "HMC",
"version": {
"version_data": [
{
"version_value": "OP940"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6529322",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6529322 (OPENBMC)",
"url": "https://www.ibm.com/support/pages/node/6529322"
},
{
"name": "ibm-openbmc-cve202138960-info-disc (212047)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212047"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-38960",
"datePublished": "2022-02-04T22:33:07.197Z",
"dateReserved": "2021-08-16T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:27:49.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38961 (GCVE-0-2021-38961)
Vulnerability from nvd – Published: 2021-12-27 17:10 – Updated: 2024-09-16 21:57
VLAI
EPSS
VEX
Summary
IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049.
Severity
CWE
- Cross-Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6536720 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2021-12-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:20.705Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6536720"
},
{
"name": "ibm-openbmc-cve202138961-xss (212049)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212049"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "OP910"
}
]
}
],
"datePublic": "2021-12-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.8,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AC:L/A:N/AV:N/I:L/C:L/UI:R/PR:N/S:C/RC:C/RL:O/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-27T17:10:10.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6536720"
},
{
"name": "ibm-openbmc-cve202138961-xss (212049)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212049"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-12-22T00:00:00",
"ID": "CVE-2021-38961",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OPENBMC",
"version": {
"version_data": [
{
"version_value": "OP910"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "N",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6536720",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6536720 (OPENBMC)",
"url": "https://www.ibm.com/support/pages/node/6536720"
},
{
"name": "ibm-openbmc-cve202138961-xss (212049)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212049"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-38961",
"datePublished": "2021-12-27T17:10:10.446Z",
"dateReserved": "2021-08-16T00:00:00.000Z",
"dateUpdated": "2024-09-16T21:57:14.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-7868 (GCVE-0-2026-7868)
Vulnerability from cvelistv5 – Published: 2026-07-28 15:59 – Updated: 2026-07-28 17:36
VLAI
EPSS
VEX
Title
This Power System update is being released to address incorrect authorization
Summary
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7280641 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | OPENBMC |
Affected:
FW1110.00 , ≤ FW1110.20
(semver)
Affected: FW1060.00 , ≤ FW1060.71 (semver) cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.20:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.20.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.71:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.71.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-7868",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T17:35:53.287045Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T17:36:01.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.20:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.20.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.71:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.71.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1110.20",
"status": "affected",
"version": "FW1110.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1060.71",
"status": "affected",
"version": "FW1060.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.\u003c/p\u003e"
}
],
"value": "IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:59:21.082Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7280641"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1110.30(1110_145) or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003cbr/\u003e1) IBM Power System S1122 (9824-22A)\u003cbr/\u003e2) IBM Power System S1124 (9824-42A)\u003cbr/\u003e3) IBM Power System S1122s (9824-22B)\u003cbr/\u003e4) IBM Power System S1114 (9824-41B)\u003cbr/\u003e5) IBM Power System L1122 (9856-22H)\u003cbr/\u003e6) IBM Power System L1124 (9856-42H)\u003cbr/\u003e7) IBM Power System E1150 (9043-MRU)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install FW1060.72(1060_177), FW1060.80(1060_185) or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003cbr/\u003e1) IBM Power System S1022 (9105-22A)\u003cbr/\u003e2) IBM Power System S1024 (9105-42A)\u003cbr/\u003e3) IBM Power System S1022s (9105-22B)\u003cbr/\u003e4) IBM Power System S1014 (9105-41B)\u003cbr/\u003e5) IBM Power System L1022 (9786-22H)\u003cbr/\u003e6) IBM Power System L1024 (9786-42H)\u003cbr/\u003e7) IBM Power System E1050 (9043-MRX)\u003cbr/\u003e8) IBM Power System S1012 (9028-21B)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central : \u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1110.30(1110_145) or newer to remediate this vulnerability.\nPower 11\n1) IBM Power System S1122 (9824-22A)\n2) IBM Power System S1124 (9824-42A)\n3) IBM Power System S1122s (9824-22B)\n4) IBM Power System S1114 (9824-41B)\n5) IBM Power System L1122 (9856-22H)\n6) IBM Power System L1124 (9856-42H)\n7) IBM Power System E1150 (9043-MRU)\n\n\n\nCustomers with the products below should install FW1060.72(1060_177), FW1060.80(1060_185) or newer to remediate this vulnerability.\nPower 10\n1) IBM Power System S1022 (9105-22A)\n2) IBM Power System S1024 (9105-42A)\n3) IBM Power System S1022s (9105-22B)\n4) IBM Power System S1014 (9105-41B)\n5) IBM Power System L1022 (9786-22H)\n6) IBM Power System L1024 (9786-42H)\n7) IBM Power System E1050 (9043-MRX)\n8) IBM Power System S1012 (9028-21B)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/"
}
],
"title": "This Power System update is being released to address incorrect authorization",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAfter applying this fix, ensure local BMC user accounts are as intended.\u00a0 You can use the BMC\u0027s ASMI web application \u0026gt; Security and access \u0026gt; User management to view BMC accounts.\u003c/p\u003e"
}
],
"value": "After applying this fix, ensure local BMC user accounts are as intended.\u00a0 You can use the BMC\u0027s ASMI web application \u003e Security and access \u003e User management to view BMC accounts."
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-7868",
"datePublished": "2026-07-28T15:59:21.082Z",
"dateReserved": "2026-05-05T14:00:11.372Z",
"dateUpdated": "2026-07-28T17:36:01.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8058 (GCVE-0-2026-8058)
Vulnerability from cvelistv5 – Published: 2026-07-28 15:56 – Updated: 2026-07-28 15:56
VLAI
EPSS
VEX
Title
This Power System update is being released to address a sensitive information disclosure
Summary
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.
Severity
4.5 (Medium)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7280642 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | OPENBMC |
Affected:
FW1110.00 , ≤ FW1110.20
(semver)
Affected: FW1060.00 , ≤ FW1060.71 (semver) cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.20:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.20.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.71:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.71.0:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.20:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.20.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.71:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.71.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1110.20",
"status": "affected",
"version": "FW1110.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1060.71",
"status": "affected",
"version": "FW1060.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.\u003c/p\u003e"
}
],
"value": "IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:56:27.745Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7280642"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1110.30(1110_145) or newer to remediate this vulnerability.\u003cbr/\u003ePower 11\u003cbr/\u003e1) IBM Power System S1122 (9824-22A)\u003cbr/\u003e2) IBM Power System S1124 (9824-42A)\u003cbr/\u003e3) IBM Power System S1122s (9824-22B)\u003cbr/\u003e4) IBM Power System S1114 (9824-41B)\u003cbr/\u003e5) IBM Power System L1122 (9856-22H)\u003cbr/\u003e6) IBM Power System L1124 (9856-42H)\u003cbr/\u003e7) IBM Power System E1150 (9043-MRU)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install 1060.72(1060_177), 1060.80(1060_185) or newer to remediate this vulnerability.\u003cbr/\u003ePower 10\u003cbr/\u003e1) IBM Power System S1022 (9105-22A)\u003cbr/\u003e2) IBM Power System S1024 (9105-42A)\u003cbr/\u003e3) IBM Power System S1022s (9105-22B)\u003cbr/\u003e4) IBM Power System S1014 (9105-41B)\u003cbr/\u003e5) IBM Power System L1022 (9786-22H)\u003cbr/\u003e6) IBM Power System L1024 (9786-42H)\u003cbr/\u003e7) IBM Power System E1050 (9043-MRX)\u003cbr/\u003e8) IBM Power System S1012 (9028-21B)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central : \u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1110.30(1110_145) or newer to remediate this vulnerability.Power 111) IBM Power System S1122 (9824-22A)2) IBM Power System S1124 (9824-42A)3) IBM Power System S1122s (9824-22B)4) IBM Power System S1114 (9824-41B)5) IBM Power System L1122 (9856-22H)6) IBM Power System L1124 (9856-42H)7) IBM Power System E1150 (9043-MRU)Customers with the products below should install 1060.72(1060_177), 1060.80(1060_185) or newer to remediate this vulnerability.Power 101) IBM Power System S1022 (9105-22A)2) IBM Power System S1024 (9105-42A)3) IBM Power System S1022s (9105-22B)4) IBM Power System S1014 (9105-41B)5) IBM Power System L1022 (9786-22H)6) IBM Power System L1024 (9786-42H)7) IBM Power System E1050 (9043-MRX)8) IBM Power System S1012 (9028-21B)The images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/"
}
],
"title": "This Power System update is being released to address a sensitive information disclosure",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProtect access to the BMC\u0027s administrative functions.\u003c/p\u003e"
}
],
"value": "Protect access to the BMC\u0027s administrative functions."
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-8058",
"datePublished": "2026-07-28T15:56:27.745Z",
"dateReserved": "2026-05-06T20:45:47.792Z",
"dateUpdated": "2026-07-28T15:56:27.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-7254 (GCVE-0-2026-7254)
Vulnerability from cvelistv5 – Published: 2026-05-27 13:12 – Updated: 2026-05-27 14:48
VLAI
EPSS
VEX
Title
Open BMC Denial of Service
Summary
IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-1284 - Improper Validation of Specified Quantity in Input
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7272993 | vendor-advisorypatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-7254",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T14:48:19.046200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T14:48:48.502Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.11:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.11.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1110.11",
"status": "affected",
"version": "FW1110.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM OPENBMC FW1110.00 through FW1110.11\u0026nbsp;\u003cspan\u003eis vulnerable to denial of service attacks by unauthenticated network users.\u003c/span\u003e\u003c/p\u003e\u003cdiv\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "IBM OPENBMC FW1110.00 through FW1110.11\u00a0is vulnerable to denial of service attacks by unauthenticated network users."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T13:13:28.863Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7272993"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1110.20(1110_130) or newer to remediate this vulnerability.\u003cbr\u003ePower 11\u003cbr\u003e1) IBM Power System S1122 (9824-22A)\u003cbr\u003e2) IBM Power System S1124 (9824-42A)\u003cbr\u003e3) IBM Power System S1122s (9824-22B)\u003cbr\u003e4) IBM Power System S1114 (9824-41B)\u003cbr\u003e5) IBM Power System L1122 (9856-22H)\u003cbr\u003e6) IBM Power System L1124 (9856-42H)\u003cbr\u003e7) IBM Power System E1150 (9043-MRU)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central : \u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1110.20(1110_130) or newer to remediate this vulnerability.\nPower 11\n1) IBM Power System S1122 (9824-22A)\n2) IBM Power System S1124 (9824-42A)\n3) IBM Power System S1122s (9824-22B)\n4) IBM Power System S1114 (9824-41B)\n5) IBM Power System L1122 (9856-22H)\n6) IBM Power System L1124 (9856-42H)\n7) IBM Power System E1150 (9043-MRU)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/"
}
],
"title": "Open BMC Denial of Service",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProtect access to the BMC\u0027s network interface.\u003c/p\u003e"
}
],
"value": "Protect access to the BMC\u0027s network interface."
}
],
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-7254",
"datePublished": "2026-05-27T13:12:06.648Z",
"dateReserved": "2026-04-27T23:05:58.869Z",
"dateUpdated": "2026-05-27T14:48:48.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-35124 (GCVE-0-2024-35124)
Vulnerability from cvelistv5 – Published: 2024-08-13 11:14 – Updated: 2024-08-13 13:07
VLAI
EPSS
VEX
Title
IBM OpenBMC authentication bypass
Summary
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7163195 | vendor-advisory |
| https://https://exchange.xforce.ibmcloud.com/vuln… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | OpenBMC |
Affected:
FW1050.00 , ≤ FW1050.10
(semver)
Affected: FW1030.00 , ≤ FW1030.50 (semver) Affected: FW1020.00 , ≤ FW1020.60 (semver) cpe:2.3:o:ibm:openbmc:FW1020.00:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1020.60:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1030.00:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1030.50:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1050.00:*:*:*:*:*:*:* cpe:2.3:o:ibm:openbmc:FW1050.10:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-35124",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-13T13:06:48.493514Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T13:07:10.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:ibm:openbmc:FW1020.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1020.60:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1030.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1030.50:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1050.00:*:*:*:*:*:*:*",
"cpe:2.3:o:ibm:openbmc:FW1050.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "OpenBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1050.10",
"status": "affected",
"version": "FW1050.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1030.50",
"status": "affected",
"version": "FW1030.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1020.60",
"status": "affected",
"version": "FW1020.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability in the combination of the OpenBMC\u0027s FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674."
}
],
"value": "A vulnerability in the combination of the OpenBMC\u0027s FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T11:14:40.227Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7163195"
},
{
"tags": [
"vdb-entry"
],
"url": "https://https://exchange.xforce.ibmcloud.com/vulnerabilities/290674"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM OpenBMC authentication bypass",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-35124",
"datePublished": "2024-08-13T11:14:40.227Z",
"dateReserved": "2024-05-09T16:27:14.739Z",
"dateUpdated": "2024-08-13T13:07:10.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-31916 (GCVE-0-2024-31916)
Vulnerability from cvelistv5 – Published: 2024-06-27 17:45 – Updated: 2024-08-02 01:59
VLAI
EPSS
VEX
Title
IBM OpenBMC information disclosure
Summary
IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7158679 | vendor-advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entry |
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1050.00:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "openbmc",
"vendor": "ibm",
"versions": [
{
"lessThanOrEqual": "fw1050.10",
"status": "affected",
"version": "fw1050.00",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-31916",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-27T19:58:11.462816Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-03T19:40:31.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:59:50.705Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/7158679"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/290026"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1050.10",
"status": "affected",
"version": "FW1050.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026."
}
],
"value": "IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-27T17:45:31.618Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/7158679"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/290026"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM OpenBMC information disclosure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2024-31916",
"datePublished": "2024-06-27T17:45:31.618Z",
"dateReserved": "2024-04-07T12:45:15.767Z",
"dateUpdated": "2024-08-02T01:59:50.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-22488 (GCVE-0-2022-22488)
Vulnerability from cvelistv5 – Published: 2022-11-18 17:02 – Updated: 2025-04-28 19:07
VLAI
EPSS
VEX
Title
IBM OpenBMC denial of service
Summary
IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- n/a
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6840155 | vendor-advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entry |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:14:55.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6840155"
},
{
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/226337"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-22488",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-28T19:06:20.249181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-28T19:07:40.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenBMC",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "OP910, OP940"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337."
}
],
"value": "IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-12T12:11:04.548Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.ibm.com/support/pages/node/6840155"
},
{
"tags": [
"vdb-entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/226337"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "IBM OpenBMC denial of service",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2022-22488",
"datePublished": "2022-11-18T17:02:01.980Z",
"dateReserved": "2022-01-03T22:29:21.008Z",
"dateUpdated": "2025-04-28T19:07:40.468Z",
"requesterUserId": "520cc88b-a1c8-44f6-9154-21a4d74c769f",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38960 (GCVE-0-2021-38960)
Vulnerability from cvelistv5 – Published: 2022-02-04 22:33 – Updated: 2024-09-16 16:27
VLAI
EPSS
VEX
Summary
IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.
Severity
CWE
- Obtain Information
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6529322 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Impacted products
Date Public
2022-02-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:20.780Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6529322"
},
{
"name": "ibm-openbmc-cve202138960-info-disc (212047)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212047"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "OP920"
},
{
"status": "affected",
"version": "OP930"
},
{
"status": "affected",
"version": "OP940"
}
]
},
{
"product": "HMC",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "OP940"
}
]
}
],
"datePublic": "2022-02-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.6,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/PR:N/I:N/AC:L/S:U/A:N/UI:N/C:L/RL:O/E:U/RC:C",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Obtain Information",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-04T22:33:07.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6529322"
},
{
"name": "ibm-openbmc-cve202138960-info-disc (212047)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212047"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2022-02-02T00:00:00",
"ID": "CVE-2021-38960",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OPENBMC",
"version": {
"version_data": [
{
"version_value": "OP920"
},
{
"version_value": "OP930"
},
{
"version_value": "OP940"
}
]
}
},
{
"product_name": "HMC",
"version": {
"version_data": [
{
"version_value": "OP940"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "N",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Obtain Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6529322",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6529322 (OPENBMC)",
"url": "https://www.ibm.com/support/pages/node/6529322"
},
{
"name": "ibm-openbmc-cve202138960-info-disc (212047)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212047"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-38960",
"datePublished": "2022-02-04T22:33:07.197Z",
"dateReserved": "2021-08-16T00:00:00.000Z",
"dateUpdated": "2024-09-16T16:27:49.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-38961 (GCVE-0-2021-38961)
Vulnerability from cvelistv5 – Published: 2021-12-27 17:10 – Updated: 2024-09-16 21:57
VLAI
EPSS
VEX
Summary
IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049.
Severity
CWE
- Cross-Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/6536720 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2021-12-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:51:20.705Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6536720"
},
{
"name": "ibm-openbmc-cve202138961-xss (212049)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212049"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "OP910"
}
]
}
],
"datePublic": "2021-12-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 5.8,
"temporalSeverity": "MEDIUM",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AC:L/A:N/AV:N/I:L/C:L/UI:R/PR:N/S:C/RC:C/RL:O/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-27T17:10:10.000Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6536720"
},
{
"name": "ibm-openbmc-cve202138961-xss (212049)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212049"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-12-22T00:00:00",
"ID": "CVE-2021-38961",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "OPENBMC",
"version": {
"version_data": [
{
"version_value": "OP910"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "N",
"S": "C",
"UI": "R"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6536720",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6536720 (OPENBMC)",
"url": "https://www.ibm.com/support/pages/node/6536720"
},
{
"name": "ibm-openbmc-cve202138961-xss (212049)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212049"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-38961",
"datePublished": "2021-12-27T17:10:10.446Z",
"dateReserved": "2021-08-16T00:00:00.000Z",
"dateUpdated": "2024-09-16T21:57:14.919Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}