CVE-2018-2566
published 2018-01-18CVE-2018-2566: Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console Application). Supported…
PriorityP340high7.7CVSS 3.0
AVNACHPRLUIRSCCHIHAN
EPSS
1.49%
71.3th percentile
Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console Application). Supported versions that are affected are 3.x and 4.x. Difficult to exploit vulnerability allows low privileged attacker with network access via TLS to compromise Integrated Lights Out Manager (ILOM). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Integrated Lights Out Manager (ILOM), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Integrated Lights Out Manager (ILOM) accessible data as well as unauthorized access to critical data or complete access to all Integrated Lights Out Manager (ILOM) accessible data. CVSS 3.0 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linuxfoundation | ceph | >= 0 < 15.2.7-0ubuntu0.20.04.2 | 15.2.7-0ubuntu0.20.04.2 |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
| oracle | integrated_lights_out_manager_firmware | — | — |
CVSS provenance
nvdv3.07.7HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mxp2-5233-73gr: Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console Application)
ghsa_unreviewed·2022-05-13
CVE-2018-2566 [HIGH] GHSA-mxp2-5233-73gr: Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console Application)
Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console Application). Supported versions that are affected are 3.x and 4.x. Difficult to exploit vulnerability allows low privileged attacker with network access via TLS to compromise Integrated Lights Out Manager (ILOM). Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Integrated Lights Out Manager (ILOM), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Integrated Lights Out Manager (ILOM) accessible data as well as unauthorized access to critical data or comp
OSV
ceph vulnerabilities
osv·2021-01-28·CVSS 7.5
CVE-2020-10736 ceph vulnerabilities
ceph vulnerabilities
Olle Segerdahl found that ceph-mon and ceph-mgr daemons did not properly
restrict access, resulting in gaining access to unauthorized resources. An
authenticated user could use this vulnerability to modify the configuration and
possibly conduct further attacks. (CVE-2020-10736)
Adam Mohammed found that Ceph Object Gateway was vulnerable to HTTP header
injection via a CORS ExposeHeader tag. An attacker could use this to gain access
or cause a crash. (CVE-2020-10753)
Ilya Dryomov found that Cephx authentication did not verify Ceph clients
correctly and was then vulnerable to replay attacks in Nautilus. An attacker
could use the Ceph cluster network to authenticate via a packet sniffer and
perform actions. This issue is a reintroduction of CVE-2018-1128.
(CVE-2020-2566
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.securityfocus.com/bid/102603http://www.securitytracker.com/id/1040205http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.securityfocus.com/bid/102603http://www.securitytracker.com/id/1040205
2018-01-18
Published