ICSA-21-336-06

Hitachi Energy APM Edge

view advisory published 2021-12-02

Successful exploitation of this vulnerability could cause the product to become inaccessible.

describes (29)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-3541US	medium6.5	2.07% (81st)	—	2021-07-09
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
CVE-2021-3516US	high7.8	2.04% (81st)	—	2021-06-01
There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The great…
CVE-2021-3517US	high8.6	17.0% (97th)	—	2021-05-19
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application li…
CVE-2021-3518US	high8.8	21.9% (98th)	—	2021-05-18
There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-afte…
CVE-2021-3537US	medium5.9	3.60% (89th)	—	2021-05-14
A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML d…
CVE-2021-3449US	medium5.9	63.5% (99th)	Exploit	2021-03-25
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms…
CVE-2021-20233US	high8.2	0.60% (48th)	Exploit	2021-03-03
A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single qu…
CVE-2021-20225US	medium6.7	1.01% (63rd)	—	2021-03-03
A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large…
CVE-2020-27779US	high7.5	0.39% (32nd)	—	2021-03-03
A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address ranges from memory crea…
CVE-2020-27749US	medium6.7	0.57% (47th)	—	2021-03-03
A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable contents, using a 1kB stack…
CVE-2020-25632US	high8.2	1.15% (67th)	Exploit	2021-03-03
A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any other dependent module i…
CVE-2020-14372US	high7.5	1.74% (78th)	Exploit	2021-03-03
A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows an attacker with privi…
CVE-2021-23841US	medium5.9OT elevated	7.41% (94th)	Exploit	2021-02-16
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate…
CVE-2021-23840US	high7.5	50.7% (99th)	Exploit	2021-02-16
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable…
CVE-2020-1971US	medium5.9	7.05% (94th)	Exploit	2020-12-08
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_c…
CVE-2020-24977US	medium6.5	2.98% (87th)	—	2020-09-04
GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e.
CVE-2020-14311US	medium6.0	0.46% (39th)	—	2020-07-31
There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32_MAX causes an arith…
CVE-2020-14310US	medium6.0	0.48% (40th)	—	2020-07-31
There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it bef…
CVE-2020-14309US	medium6.7	0.48% (41st)	—	2020-07-30
There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads…
CVE-2020-10713US	high8.2	1.71% (77th)	Exploit	2020-07-30
A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure…

showing 20 of 29

references

External citations — patches, advisories, analysis.

ICS Advisory ICSA-21-336-06 JSONself
Recommended Practicesexternal
Recommended Practicesexternal
ICS Advisory ICSA-21-336-06 Web Versionself

remediations (58)

MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
MitigationAPM Edge
Do not directly connect to the Internet.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.
FixedAPM Edge
Hitachi Energy recommends users update to Transformer APM Edge v4.0. This version updates the software components to remediate this vulnerability.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan