CVE-2021-4212

A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-3897

An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 FPC2 and Lenovo System Management Module SMM firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected...

CVE-2021-4210

A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-3849

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 FPC2 and Lenovo System Management Module SMM firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected...

CVE-2021-3897

An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 FPC2 and Lenovo System Management Module SMM firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected...

CVE-2021-3849

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 FPC2 and Lenovo System Management Module SMM firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected...

CVE-2021-3897

CVE-2021-3897 describes an authentication bypass in internal services of Lenovo’s Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware, with SMM2 reportedly not affected. Multiple connected sources confirm the vulnerability could allow an unauthenticated attacker...

PT-2022-10823 · Lenovo · Lenovo System Management Module +1

Name of the Vulnerable Software and Affected Versions: Lenovo Fan Power Controller2 FPC2 and Lenovo System Management Module SMM firmware affected versions not specified SMM2 is not affected. Description: An authentication bypass issue was discovered in an internal service of the Lenovo Fan Power...

CVE-2021-3897: Authentication Bypass Using an Alternate Path or Channel

An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 FPC2 and Lenovo System Management Module SMM firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected...

CVE-2021-3849: Authentication Bypass Using an Alternate Path or Channel

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 FPC2 and Lenovo System Management Module SMM firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected...

PT-2022-10733 · Lenovo · Lenovo System Management Module +1

Name of the Vulnerable Software and Affected Versions: Lenovo Fan Power Controller2 FPC2 affected versions not specified Lenovo System Management Module SMM affected versions not specified Description: An authentication bypass issue was found in the web interface of the Lenovo Fan Power Controlle...

CVE-2022-22558

Dell PowerEdge Server BIOS and Dell Precision Workstation 7910 and 7920 Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A Local High Privileged attacker could potentially exploit this vulnerability leading to arbitrary writes or denial of service...

Dell PowerEdge Server BIOS 缓冲区错误漏洞

Dell PowerEdge Server BIOS is a system update driver for Dell, a Dell USA company. The Dell PowerEdge Server BIOS suffers from a buffer error vulnerability that stems from the inclusion of an incorrect SMM communications buffer validation vulnerability in the BIOS. A local, elevated privilege...

The vulnerability of Lenovo Variable SMI microprogramming software in Lenovo laptops allows attackers to elevate their privileges and execute arbitrary code.

The vulnerability of Lenovo’s SMI microprogramming software for BIOS on Lenovo laptops lies in the ability to pass the physical address of a specially created buffer as a parameter to the SMI handler. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute...

Important: Red Hat Security Advisory: Satellite 6.9.9 Async Bug Fix Update

Updated Satellite 6.9 packages that fix several bugs are now available for Red Hat Satellite. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other clien...

Lenovo Notebook 输入验证错误漏洞

Lenovo Notebook is a laptop computer from Lenovo, a Chinese company. The Lenovo Notebook suffers from an input validation error vulnerability that exists due to insufficient validation of user-supplied input in the LenovoVariable SMI handler. A local user can run a specially crafted program to...

The vulnerability of the LenovoFlashDeviceInterface interface in the System Management Interrupt (SMI) handling of the BIOS of ThinkPad notebook software allows a attacker to execute arbitrary code with elevated privileges.

The vulnerability of the LenovoFlashDeviceInterface interface in the System Management Interrupt SMI handling of BIOS microprogramming systems in ThinkPad laptops is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows an attacker to execute...

Privilege Defined With Unsafe Actions

Overview System.Management.Automation is a System Management Automation for PowerShell. Affected versions of this package are vulnerable to Privilege Defined With Unsafe Actions in the module search paths that will return empty strings for special folders that don't exist in some accounts like...

Lenovo ThinkPad 权限许可和访问控制问题漏洞

Lenovo ThinkPad is a portable computer from Lenovo, a Chinese company. The Lenovo ThinkPad BIOS is vulnerable to a privilege-granting and access-control issue that arises from the use of boot services in the SmmOEMInt15 SMI handler. A local attacker could bypass implemented security restrictions...

Lenovo ThinkPad 缓冲区错误漏洞

Lenovo ThinkPad is a portable computer from Lenovo, a Chinese company. The Lenovo ThinkPad BIOS suffers from a buffer error vulnerability that originates from a boundary error in the LenovoFlashDeviceInterface within the SMI handler. A local attacker could run a specially crafted program to trigg...