VARIoT IoT vulnerabilities database

Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Intel Data Center Manager Vendor URL: https://www.intel.com/content/www/us/en/developer/tools/data-center-manager-console/overview.html Type: Authentication Bypass by Spoofing [CWE-290] Date found: 2022-06-01 Date published: 2022-11-23 CVSSv3 Score: 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) CVE: CVE-2022-33942 2. CREDITS ========== This vulnerability was discovered and researched by Julien Ahrens from RCE Security. 3. VERSIONS AFFECTED ==================== Intel Data Center Manager 4.1.1.45749 and below 4. INTRODUCTION =============== Energy costs are the fastest rising expense for today’s data centers. Intel® Data Center Manager (Intel® DCM) provides real-time power and thermal consumption data, giving you the clarity you need to lower power usage, increase rack density, and prolong operation during outages. (from the vendor's homepage) 5. VULNERABILITY DETAILS ======================== The application allows configuring authentication via Active Directory groups. While this by itself isn't an issue, it becomes one as soon as an Active Directory group with a well-known SID (such as "S-1-5-32-544" or "S-1-5-32-546") is configured to allow authentication to DCM. This is because Intel's DCM only relies on the group's SID to allow authentication but doesn't verify the authenticating domain, which the user can give during the authentication process against the DCM Console and its REST interface. Since the DCM will send all Kerberos and LDAP (authentication) requests against the given domain, it is trivially easy to spoof the authentication responses by using an arbitrary Kerberos and LDAP server and replying with the SID of one of the configured Active Directory groups. This allows an attacker to bypass the authentication schema by using any domain with any user/password combination without actually being part of any Active Directory groups. 6. PROOF OF CONCEPT =================== See the referenced blog post for a full exploit. 7. SOLUTION =========== Update to Intel DCM 5.0 or later 8. REPORT TIMELINE ================== 2022-06-01: Discovery of the vulnerability 2022-06-28: Sent notification to Intel via their PSIRT 2022-06-28: Vendor response: Sent to appropriate reviewers. 2022-06-29: Vendor acknowledges the vulnerability and asks for coordinated disclosure on Nov. 8, 2022 2022-06-30: Rejected the disclosure date, due to my own policy, which makes it: August 13, 2022 2022-07-08: After a vendor call, I've submitted the issue through Intel's bug bounty program 2022-xx-xx: Vendor releases version 5.0 without any notification which fixes this vulnerability 2022-11-08: Vendor (responsible CNA) assigns CVE-2022-33942 2022-11-08: Vendor publishes security advisory INTEL-SA-00713 2022-11-23: Public disclosure 9. REFERENCES ============= https://www.rcesecurity.com/2022/11/from-zero-to-hero-part-1-bypassing-intel-dcms-authentication-by-spoofing-kerberos-and-ldap-responses-cve-2022-33942 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html https://github.com/MrTuxracer/advisories

Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow an authenticated user to potentially enable denial of service via local access. Intel NUC is a small mini computer from Intel Corporation of the United States

Uncontrolled search path element in the PresentMon software maintained by Intel(R) before version 1.7.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Intel's gametechdev presentmon Exists in a vulnerability in an element of an uncontrolled search path.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) MC before version 2.3.2 may allow an authenticated user to potentially enable escalation of privilege via network access. Intel's Intel Active Management Technology Software Development Kit , Intel Endpoint Management Assistant (EMA) , manageability commander There are vulnerabilities in inadequate protection of credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Uncontrolled search path element in the Intel(R) Advanced Link Analyzer Pro before version 22.2 and Standard edition software before version 22.1.1 STD may allow an authenticated user to potentially enable escalation of privilege via local access

Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Intel's Intel VTune Profiler Exists in a vulnerability in an element of an uncontrolled search path.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Intel VTune Profiler is a performance testing tool used by Intel Corporation for optimizing software. The software can perform performance testing on IoT embedded applications, media software, Java applications, and high-performance computing applications

Uncontrolled search path element in the Intel(R) Glorp software may allow an authenticated user to potentially enable escalation of privilege via local access

Cross-site scripting in the Intel(R) EMA software before version 1.8.0 may allow a privileged user to potentially enable escalation of privilege via local access

Uncontrolled search path in the software installer for Intel(R) System Studio for all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. Intel's Intel System Studio Exists in a vulnerability in an element of an uncontrolled search path.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Intel System Studio is a multi-functional, cross-platform tool suite from Intel Corporation. Designed to simplify system startup and improve system and IoT device application performance on Intel platforms

Eclipse Californium is a Java implementation of RFC7252 - Constrained Application Protocol for IoT Cloud services. In versions prior to 3.7.0, and 2.7.4, Californium is vulnerable to a Denial of Service. Failing handshakes don't cleanup counters for throttling, causing the threshold to be reached without being released again. This results in permanently dropping records. The issue was reported for certificate based handshakes, but may also affect PSK based handshakes. It generally affects client and server as well. This issue is patched in version 3.7.0 and 2.7.4. There are no known workarounds. main: commit 726bac57659410da463dcf404b3e79a7312ac0b9 2.7.x: commit 5648a0c27c2c2667c98419254557a14bac2b1f3f. Eclipse Californium is a Java-based code library that provides Coap backend support for the Internet of Things from the Eclipse Foundation. The vulnerability can be exploited by an attacker to perform a denial of service attack. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Integration Camel for Spring Boot 3.20.1 security update Advisory ID: RHSA-2023:2100-01 Product: Red Hat Integration Advisory URL: https://access.redhat.com/errata/RHSA-2023:2100 Issue date: 2023-05-03 CVE Names: CVE-2021-37533 CVE-2022-4492 CVE-2022-25857 CVE-2022-31777 CVE-2022-33681 CVE-2022-37865 CVE-2022-37866 CVE-2022-38398 CVE-2022-38648 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752 CVE-2022-39368 CVE-2022-40146 CVE-2022-40150 CVE-2022-40151 CVE-2022-40152 CVE-2022-40156 CVE-2022-41704 CVE-2022-41852 CVE-2022-41853 CVE-2022-41854 CVE-2022-41881 CVE-2022-41966 CVE-2022-42003 CVE-2022-42004 CVE-2022-42890 CVE-2023-1370 CVE-2023-1436 CVE-2023-20860 CVE-2023-20861 CVE-2023-20863 CVE-2023-22602 CVE-2023-24998 ===================================================================== 1. Summary: Red Hat Integration Camel for Spring Boot 3.20.1 release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: This release of Camel for Spring Boot 3.20.1 serves as a replacement for Camel for Spring Boot 3.18.3 and includes bug fixes and enhancements, which are documented in the Release Notes document linked in the References. The purpose of this text-only errata is to inform you about the security issues fixed. Security Fix(es): * snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857) * JXPath: untrusted XPath expressions may lead to RCE attack (CVE-2022-41852) * hsqldb: Untrusted input may lead to RCE attack (CVE-2022-41853) * xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow (CVE-2022-41966) * springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern (CVE-2023-20860) * apache-commons-net: FTP client trusts the host from PASV response by default (CVE-2021-37533) * undertow: Server identity in https connection is not checked by the undertow client (CVE-2022-4492) * apache-spark: XSS vulnerability in log viewer UI Javascript (CVE-2022-31777) * Apache Pulsar: Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM (CVE-2022-33681) * apache-ivy: Directory Traversal (CVE-2022-37865) * : Apache Ivy: Ivy Path traversal (CVE-2022-37866) * batik: Server-Side Request Forgery (CVE-2022-38398) * batik: Server-Side Request Forgery (CVE-2022-38648) * snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749) * snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750) * snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751) * snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode (CVE-2022-38752) * scandium: Failing DTLS handshakes may cause throttling to block processing of records (CVE-2022-39368) * batik: Server-Side Request Forgery (SSRF) vulnerability (CVE-2022-40146) * xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40151) * woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152) * xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40156) * batik: Apache XML Graphics Batik vulnerable to code execution via SVG (CVE-2022-41704) * dev-java/snakeyaml: DoS via stack overflow (CVE-2022-41854) * codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS (CVE-2022-41881) * jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003) * jackson-databind: use of deeply nested arrays (CVE-2022-42004) * batik: Untrusted code execution in Apache XML Graphics Batik (CVE-2022-42890) * jettison: Uncontrolled Recursion in JSONArray (CVE-2023-1436) * springframework: Spring Expression DoS Vulnerability (CVE-2023-20861) * shiro: Authentication bypass through a specially crafted HTTP request (CVE-2023-22602) * Apache Commons FileUpload: FileUpload DoS with excessive parts (CVE-2023-24998) * jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150) * springframework: Spring Expression DoS Vulnerability (CVE-2023-20863) * json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) (CVE-2023-1370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 2126789 - CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections 2129706 - CVE-2022-38749 snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode 2129707 - CVE-2022-38750 snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject 2129709 - CVE-2022-38751 snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match 2129710 - CVE-2022-38752 snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode 2134288 - CVE-2022-40156 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks 2134291 - CVE-2022-40152 woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks 2134292 - CVE-2022-40151 xstream: Xstream to serialise XML data was vulnerable to Denial of Service attacks 2135244 - CVE-2022-42003 jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS 2135247 - CVE-2022-42004 jackson-databind: use of deeply nested arrays 2135770 - CVE-2022-40150 jettison: memory exhaustion via user-supplied XML or JSON data 2136128 - CVE-2022-41852 JXPath: untrusted XPath expressions may lead to RCE attack 2136141 - CVE-2022-41853 hsqldb: Untrusted input may lead to RCE attack 2136207 - CVE-2022-33681 Apache Pulsar: Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM 2145205 - CVE-2022-39368 scandium: Failing DTLS handshakes may cause throttling to block processing of records 2145264 - CVE-2022-31777 apache-spark: XSS vulnerability in log viewer UI Javascript 2150011 - CVE-2022-37866 : Apache Ivy: Ivy Path traversal 2151988 - CVE-2022-41854 dev-java/snakeyaml: DoS via stack overflow 2153260 - CVE-2022-4492 undertow: Server identity in https connection is not checked by the undertow client 2153379 - CVE-2022-41881 codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS 2155291 - CVE-2022-40146 batik: Server-Side Request Forgery (SSRF) vulnerability 2155292 - CVE-2022-38398 batik: Server-Side Request Forgery 2155295 - CVE-2022-38648 batik: Server-Side Request Forgery 2169924 - CVE-2021-37533 apache-commons-net: FTP client trusts the host from PASV response by default 2170431 - CVE-2022-41966 xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow 2172298 - CVE-2023-24998 Apache Commons FileUpload: FileUpload DoS with excessive parts 2180528 - CVE-2023-20860 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern 2180530 - CVE-2023-20861 springframework: Spring Expression DoS Vulnerability 2182182 - CVE-2022-41704 batik: Apache XML Graphics Batik vulnerable to code execution via SVG 2182183 - CVE-2022-42890 batik: Untrusted code execution in Apache XML Graphics Batik 2182188 - CVE-2022-37865 apache-ivy: Directory Traversal 2182198 - CVE-2023-22602 shiro: Authentication bypass through a specially crafted HTTP request 2182788 - CVE-2023-1436 jettison: Uncontrolled Recursion in JSONArray 2187742 - CVE-2023-20863 springframework: Spring Expression DoS Vulnerability 2188542 - CVE-2023-1370 json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) 5. References: https://access.redhat.com/security/cve/CVE-2021-37533 https://access.redhat.com/security/cve/CVE-2022-4492 https://access.redhat.com/security/cve/CVE-2022-25857 https://access.redhat.com/security/cve/CVE-2022-31777 https://access.redhat.com/security/cve/CVE-2022-33681 https://access.redhat.com/security/cve/CVE-2022-37865 https://access.redhat.com/security/cve/CVE-2022-37866 https://access.redhat.com/security/cve/CVE-2022-38398 https://access.redhat.com/security/cve/CVE-2022-38648 https://access.redhat.com/security/cve/CVE-2022-38749 https://access.redhat.com/security/cve/CVE-2022-38750 https://access.redhat.com/security/cve/CVE-2022-38751 https://access.redhat.com/security/cve/CVE-2022-38752 https://access.redhat.com/security/cve/CVE-2022-39368 https://access.redhat.com/security/cve/CVE-2022-40146 https://access.redhat.com/security/cve/CVE-2022-40150 https://access.redhat.com/security/cve/CVE-2022-40151 https://access.redhat.com/security/cve/CVE-2022-40152 https://access.redhat.com/security/cve/CVE-2022-40156 https://access.redhat.com/security/cve/CVE-2022-41704 https://access.redhat.com/security/cve/CVE-2022-41852 https://access.redhat.com/security/cve/CVE-2022-41853 https://access.redhat.com/security/cve/CVE-2022-41854 https://access.redhat.com/security/cve/CVE-2022-41881 https://access.redhat.com/security/cve/CVE-2022-41966 https://access.redhat.com/security/cve/CVE-2022-42003 https://access.redhat.com/security/cve/CVE-2022-42004 https://access.redhat.com/security/cve/CVE-2022-42890 https://access.redhat.com/security/cve/CVE-2023-1370 https://access.redhat.com/security/cve/CVE-2023-1436 https://access.redhat.com/security/cve/CVE-2023-20860 https://access.redhat.com/security/cve/CVE-2023-20861 https://access.redhat.com/security/cve/CVE-2023-20863 https://access.redhat.com/security/cve/CVE-2023-22602 https://access.redhat.com/security/cve/CVE-2023-24998 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=red.hat.integration&version=2023-Q2 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZFKf5tzjgjWX9erEAQhIqg//XeYlOwVssDc5dWFf02uXELWr1vTurtJ+ 7QGG8kgacPOojp8CHqFy1Bgyt0XIRQq75pwaFRjG4ea2Tbfusr77ZDq9Yq/wl18p 4U8FZ885MIaTYPt+xK2kNVf0c0qJAxwIcA9h+FSrmETpNxPcf2axexpbyRNdSLIv 3Oet0spu1hpJl0agTZ214dRFODuLq/ZylBueAQB0D1UbUFwdhs0Ay/LdGxvq6fNp HcZU8YQvhbTCgqV3Hr4Y9wsgvyjENoLkp6QhaD38Jgp3JvXwFLbLfvZNRZn7ILKx VIz4Tqr1qrEMzsX0gZuM2H5fIjriXezhrPKvy6V2aA6rHws2p1DociAGepQmCL64 Obc6UE36z5ebu7yGXMzzcuxE4TP7rrAokEqEjVngysitXoFHlt3CdNFrfaHU8fOc HykRqQm0BhMKGtocLUSG9Ykw/k0AbX0ZtDqrLjsjTJczulJXm43qEN0KQZjZEz78 5OHTThAs7Cz3l77NMvk6XTOsr+kxYLoJdmdfWPkyeFjqZ73F7DR6KZLSNOuho5mE rNI24kXfC/1NwqyteG/3936kO1nHHWx4X3s9IQ/JHCLe7vnsAt3tEi1MUG16tvpb dSnn728JfYB1L8IdYNh+BUgEmc2P5KaMb+wpilffsW3lIgwKOsFa/Z6noMeJCjiO 4+sH8zYm/3A= =u6p/ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Bugs fixed (https://bugzilla.redhat.com/): 2145205 - CVE-2022-39368 scandium: Failing DTLS handshakes may cause throttling to block processing of records 2149841 - CVE-2022-4244 codehaus-plexus: Directory Traversal 2149843 - CVE-2022-4245 codehaus-plexus: XML External Entity (XXE) Injection 2153399 - CVE-2022-41946 postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions 2155681 - CVE-2022-46363 Apache CXF: directory listing / code exfiltration 2188542 - CVE-2023-1370 json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) 5

A vulnerability has been identified in SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6GK7543-1MX00-0XE0) (All versions < V2.4.8). Casting an internal value could lead to floating point exception under certain circumstances. This could allow an attacker to cause a denial of service condition on affected devices. Siemens' siplus tim 1531 irc The firmware contains a vulnerability regarding incorrect conversion between numeric types.Service operation interruption (DoS) It may be in a state. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an authenticated user to potentially enable escalation of privilege via network access

A vulnerability in dynamic access policies (DAP) functionality of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to improper processing of HostScan data received from the Posture (HostScan) module. An attacker could exploit this vulnerability by sending crafted HostScan data to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dap-dos-GhYZBxDU ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ftd-dap-dos-GhYZBxDU"] This advisory is part of the November 2022 release of the Cisco ASA, FTD, and FMC Security Advisory Bundled publication

Improper authentication in subsystem for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow a privileged user to potentially enable escalation of privilege via local access. Intel's Intel Active Management Technology An authentication vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service and an limited out-of-bounds read. 750-8100 firmware, 750-8101 firmware, 750-8101/025-000 firmware etc. WAGO The product contains an out-of-bounds read vulnerability.Information is obtained and service operation is interrupted (DoS) It may be in a state

In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to crash the iocheck process and write memory resulting in loss of integrity and DoS. 750-8100 firmware, 750-8101 firmware, 750-8101/025-000 firmware etc. WAGO The product contains a classic buffer overflow vulnerability.Information is tampered with and service operation is interrupted (DoS) It may be in a state

A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when a device initiates SSL/TLS connections. An attacker could exploit this vulnerability by ensuring that the device will connect to an SSL/TLS server that is using specific encryption parameters. A successful exploit could allow the attacker to cause the affected device to unexpectedly reload, resulting in a DoS condition

In WAGO I/O-Check Service in multiple products an unauthenticated remote attacker can send a specially crafted packet containing OS commands to provoke a denial of service. 750-8100 firmware, 750-8101 firmware, 750-8101/025-000 firmware etc. WAGO The product contains a resource allocation vulnerability without limits or throttling.Service operation interruption (DoS) It may be in a state

In WAGO I/O-Check Service in multiple products an attacker can send a specially crafted packet containing OS commands to crash the diagnostic tool and write memory. 750-8100 firmware, 750-8101 firmware, 750-8101/025-000 firmware etc. WAGO The product contains a vulnerability related to out-of-bounds writes.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Missing release of memory after effective lifetime in firmware for Intel(R) SPS before versions SPS_E3_06.00.03.035.0 may allow a privileged user to potentially enable denial of service via local access. Intel's Intel Server Platform Services A vulnerability exists in firmware related to lack of freeing memory after expiration.Service operation interruption (DoS) It may be in a state