Thinksystem Smm (Lenovo) - vulnerabilities (CVEs)
9 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2018-11-27. Vendor: Lenovo.
CVEs of Thinksystem Smm
- CVE-2018-16089 - CVSS 7.5 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing…
- CVE-2018-16092 - CVSS 8.1 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information;…
- CVE-2018-16096 - CVSS 6.1 (medium), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML…
- CVE-2018-16091 - CVSS 8.1 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows.
- CVE-2018-16095 - CVSS 5.9 (medium), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails.
- CVE-2018-9084 - CVSS 6.5 (medium), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be…
- CVE-2018-16090 - CVSS 7.5 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.
- CVE-2018-16094 - CVSS 8.1 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow.
- CVE-2018-9083 - CVSS 8.1 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if…
