GCVE - cpe:2.3:a:ibm:powervc:1.2.0.0:*:*:*:express:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ibm:powervc:1.2.0.0:*:*:*:express:*:*:*

part: a version: 1.2.0.0 update: *

Vendor	Ibm (`177c0602-9232-5933-8f2f-9d22f079d22d`)
Product	Powervc (`a3b8253a-2eef-5e45-a5aa-e2b1a9f1c371`)
Edition	*
Language	*
Software edition	express
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-1937`	vulnerable	2026-06-08 05:06:26.929346	Details available IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a session on port 27017. Published: 2015-05-30T19:00:00.000Z Updated: 2024-08-06T05:02:41.853Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=nas8N1020731 http://www.securityfocus.com/bid/74911 http://www-01.ibm.com/support/docview.wss?uid=swg1IT08806	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-0136`	vulnerable	2026-06-08 05:06:13.707073	Details available powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management, which allows local users to obtain sensitive information by listing the process. Published: 2015-03-24T00:00:00.000Z Updated: 2024-08-06T04:03:08.963Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=nas8N1020608	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4750`	vulnerable	2026-06-08 05:05:45.689832	Details available IBM PowerVC Express Edition 1.2.0 before FixPack3 establishes an FTP session for transferring files to a managed IVM, which allows remote attackers to discover credentials by sniffing the network. Published: 2014-08-20T10:00:00.000Z Updated: 2024-08-06T11:27:36.089Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/94352 http://www-01.ibm.com/support/docview.wss?uid=nas8N1020223 http://www.securityfocus.com/bid/69299	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-4749`	vulnerable	2026-06-08 05:05:45.686783	Details available IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key. Published: 2014-08-20T10:00:00.000Z Updated: 2024-08-06T11:27:36.140Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=nas8N1020224 https://exchange.xforce.ibmcloud.com/vulnerabilities/94351	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3093`	vulnerable	2026-06-08 05:05:31.132163	Details available IBM PowerVC 1.2.0 before FP3 and 1.2.1 before FP2 uses cleartext passwords in (1) api-paste.ini, (2) debug logs, (3) the installation process, (4) environment checks, (5) powervc-ldap-config, (6) powervc-restore, and (7) powervc-diag, which allows local users to obtain sensitive information by entering a ps command or reading a file. Published: 2014-08-29T10:00:00.000Z Updated: 2024-08-06T10:35:55.808Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=nas8N1020242 http://www.securityfocus.com/bid/69437 https://exchange.xforce.ibmcloud.com/vulnerabilities/94259	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.