Search Results (Refine Search)
- Results Type: Overview
- Keyword (text search): cpe:2.3:h:lenovo:thinkagile_hx_enclosure_7x81:-:*:*:*:*:*:*:*
- CPE Name Search: true
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2018-9084 |
In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented. Published: November 27, 2018; 9:29:00 AM -0500 |
V3.0: 6.5 MEDIUM V2.0: 4.0 MEDIUM |
CVE-2018-9083 |
In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability. Published: November 27, 2018; 9:29:00 AM -0500 |
V3.0: 8.1 HIGH V2.0: 9.3 HIGH |
CVE-2018-16096 |
In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting. Published: November 27, 2018; 9:29:00 AM -0500 |
V3.0: 6.1 MEDIUM V2.0: 4.3 MEDIUM |
CVE-2018-16095 |
In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails. Published: November 27, 2018; 9:29:00 AM -0500 |
V3.0: 5.9 MEDIUM V2.0: 4.3 MEDIUM |
CVE-2018-16094 |
In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow. Published: November 27, 2018; 9:29:00 AM -0500 |
V3.0: 8.1 HIGH V2.0: 6.8 MEDIUM |
CVE-2018-16092 |
In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file. Published: November 27, 2018; 9:29:00 AM -0500 |
V3.0: 8.1 HIGH V2.0: 4.3 MEDIUM |
CVE-2018-16091 |
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows. Published: November 27, 2018; 9:29:00 AM -0500 |
V3.0: 8.1 HIGH V2.0: 6.8 MEDIUM |
CVE-2018-16090 |
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection. Published: November 27, 2018; 9:29:00 AM -0500 |
V3.0: 7.5 HIGH V2.0: 6.0 MEDIUM |
CVE-2018-16089 |
In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user. Published: November 27, 2018; 9:29:00 AM -0500 |
V3.0: 7.5 HIGH V2.0: 8.5 HIGH |