EUVD-2017-12892

Malware in sbrugna...

EUVD-2016-9074

Malware in sbrugna...

EUVD-2017-12861

Malware in sbrugna...

EUVD-2018-20671

Malware in sbrugna...

EUVD-2017-12885

Malware in sbrugna...

Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by information disclosure vulnerability (CVE-2019-6157)

Summary IBM Integrated Management Module II IMM2 has addressed the following information disclosure vulnerability. Vulnerability Details CVEID: CVE-2019-6157 DESCRIPTION: Lenovo System x could allow a local attacker to obtain sensitive information, caused by an issue with including private key...

CVE-2020-8332: Time-of-check Time-of-use (TOCTOU) Race Condition

A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected...

CVE-2020-8340: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 Integrated Management Module 2, prior to version 5.60, embedded Baseboard Management Controller BMC web interface during an internal security review. This vulnerability could allow JavaScript code t...

CVE-2019-6157

In various firmware versions of Lenovo System x, the integrated management module II IMM2's first failure data capture FFDC includes the web server's private key in the generated log file for support...

CVE-2019-6157

In various firmware versions of Lenovo System x, the integrated management module II IMM2's first failure data capture FFDC includes the web server's private key in the generated log file for support...

PT-2019-17990

Name of the Vulnerable Software and Affected Versions Lenovo System x affected versions not specified Description The issue concerns the integrated management module II IMM2's first failure data capture FFDC in various firmware versions of Lenovo System x. The FFDC includes the web server's priva...

CVE-2019-6157: Insertion of Sensitive Information into Log File

In various firmware versions of Lenovo System x, the integrated management module II IMM2's first failure data capture FFDC includes the web server's private key in the generated log file for support...

Missing System x Flash Memory Write Protection Lock Bit

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...

CVE-2018-9085: Incorrect Default Permissions

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...

CVE-2018-9068

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

CVE-2018-9068

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

CVE-2018-9068

The CVE-2018-9068 issue affects IBM/Lenovo Integrated Management Module II (IMM2) FFDC data disclosure. In affected IMM2 firmware (Lenovo System x prior to 4.90 and IBM System x prior to 6.80), the SFTP server used for FFDC data access used hard-coded credentials described in the IMM2 documentati...

PT-2018-18829

Name of the Vulnerable Software and Affected Versions Lenovo System x versions prior to 4.90 IBM System x versions prior to 6.80 Description The issue concerns the IMM2 First Failure Data Capture function, which collects management module logs and diagnostic information when a hardware error is...

CVE-2018-9068: Use of Hard-coded Credentials

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

CVE-2017-3775

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...