Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
lenovo system management module firmware vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv3
CVE-2018-9084
In System Management Module (SMM) versions before 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented.
Lenovo System Management Module Firmware
8.1
CVSSv3
CVE-2018-16094
In System Management Module (SMM) versions before 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow.
Lenovo System Management Module Firmware
8.1
CVSSv3
CVE-2018-9083
In System Management Module (SMM) versions before 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability.
Lenovo System Management Module Firmware
7.5
CVSSv3
CVE-2018-16089
In System Management Module (SMM) versions before 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user.
Lenovo System Management Module Firmware
7.5
CVSSv3
CVE-2018-16090
In System Management Module (SMM) versions before 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.
Lenovo System Management Module Firmware
8.1
CVSSv3
CVE-2018-16091
In System Management Module (SMM) versions before 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows.
Lenovo System Management Module Firmware
8.1
CVSSv3
CVE-2018-16092
In System Management Module (SMM) versions before 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file.
Lenovo System Management Module Firmware
5.9
CVSSv3
CVE-2018-16095
In System Management Module (SMM) versions before 1.06, the SMM records hashed passwords to a debug log when user authentication fails.
Lenovo System Management Module Firmware
6.1
CVSSv3
CVE-2018-16096
In System Management Module (SMM) versions before 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting.
Lenovo System Management Module Firmware
6.5
CVSSv3
CVE-2017-3744
In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear tex...
Lenovo Integrated Management Module Firmware
Ibm Integrated Management Module Firmware
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
buffer overflow
type confusion
server-side request forgery
CVE-2024-38440
CVE-2024-27801
CVE-2024-5868
CVE-2024-0582
CVE-2024-37643
CVE-2024-3105
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »