984 matches found
CVE-2018-12182
Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access...
CVE-2018-12182
Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access...
PT-2019-8876 · Intel +2 · Edk Ii +2
Name of the Vulnerable Software and Affected Versions: EDK II affected versions not specified Description: The issue is related to an insufficient memory write check in the SMM service, which may allow an authenticated user to potentially enable escalation of privilege, information disclosure,...
AMI BIOS System Management Mode Vulnerability - Lenovo Support US
No description provided...
CVE-2018-16089
In System Management Module SMM versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user...
CVE-2018-16094
In System Management Module SMM versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow...
CVE-2018-9083
In System Management Module SMM versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability...
Command injection
In System Management Module SMM versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user...
CVE-2018-16096
In System Management Module SMM versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting...
Command injection
In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection...
CVE-2018-16096
In System Management Module SMM versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting...
Code injection
In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...
CVE-2018-16092
In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...
CVE-2018-9084
CVE-2018-9084 affects Lenovo System Management Module (SMM) firmware prior to 1.06. If an attacker logs into the device OS, the validation of software updates can be circumvented. The Lenovo advisory LEN-24374 recommends upgrading SMM firmware to the stated level for your model and applying stand...
CVE-2018-16091
CVE-2018-16091 affects Lenovo System Management Module firmware older than 1.06, where the SMM certificate creation/parsing logic is vulnerable to several buffer overflows. The Lenovo advisory LEN-24374 lists this CVE among others and recommends upgrading SMM firmware to a newer level, and applyi...
CVE-2018-16096
The CVE-2018-16096 issue affects Lenovo System Management Module (SMM) firmware prerelease 1.06, where the SMM web interface for changing Enclosure VPD fails to sanitize all HTML inputs, creating a cross-site scripting risk. The vulnerability is documented alongside other SMM flaws in Lenovo LEN-...
CVE-2018-9083 System Management Module Vulnerabilities
In System Management Module SMM versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability...
CVE-2018-16092
CVE-2018-16092 affects Lenovo System Management Module (SMM) firmware prior to 1.06. The FFDC feature collects SMM system files, including sensitive data such as SMM user credentials and the system shadow file. This exposure could lead to confidentiality impact if FFDC data is accessed or misused...
CVE-2018-16094
Affected component: Lenovo System Management Module (SMM) firmware. Vulnerability: In SMM versions prior to 1.06, an internal function that retrieves configuration settings is susceptible to a buffer overflow. Impact: Exploitation could compromise SMM processing semantics as described in the Leno...