CVE-2018-16091: Improper Restriction of Operations within the Bounds of a Memory Buffer

In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows...

CVE-2018-16095: Insertion of Sensitive Information into Log File

In System Management Module SMM versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails...

CVE-2018-9083: Use of Hard-coded Credentials

In System Management Module SMM versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability...

CVE-2018-16090: Improper Neutralization of Special Elements used in an OS Command

In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection...

CVE-2018-9084: Undefined Security Weakness

In System Management Module SMM versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented...

PT-2018-13405

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns the collection of sensitive information by the FFDC feature in the SMM. This feature collects SMM system files, which include SMM user account credentials and t...

PT-2018-13404

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue affects the SMM certificate creation and parsing logic, making it susceptible to several buffer overflows. Recommendations For versions prior to 1.06, update to version...

PT-2018-13407

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue is related to an internal function in the System Management Module SMM that retrieves configuration settings, which is prone to a buffer overflow. Recommendations For...

PT-2018-13409

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue is related to the SMM web interface, specifically the part responsible for changing Enclosure VPD. It fails to properly sanitize input for HTML tags, which could lead to...

PT-2018-13403

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns the SMM certificate creation and parsing logic, which is susceptible to post-authentication command injection. This means that after a user has authenticated, a...

PT-2018-13408

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns the recording of hashed passwords to a debug log when user authentication fails. Recommendations For versions prior to 1.06, update to version 1.06 or later to...

PT-2018-18845

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue allows an attacker who has gained access to the device OS to bypass the validation of software updates. Recommendations For versions prior to 1.06, update to version 1.0...

CVE-2018-16096: Improper Neutralization of Input During Web Page Generation

In System Management Module SMM versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting...

PT-2018-18844

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns weak default root credentials in the System Management Module SMM. These credentials could potentially be used to log in to the device OS if an attacker...

CVE-2018-16089: Improper Neutralization of Special Elements used in an OS Command

In System Management Module SMM versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user...

CVE-2018-16094: Improper Restriction of Operations within the Bounds of a Memory Buffer

In System Management Module SMM versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow...

CVE-2018-16092: Undefined Security Weakness

In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...

[SECURITY] Fedora 27 Update: ruby-2.4.5-90.fc27

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...

HPE System Management Homepage Issue (CVE-2017-12544) - Ver2

A vulnerability exists in HPE System Management Homepage. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

[SECURITY] Fedora 28 Update: ruby-2.5.3-94.fc28

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks as in Perl. It is simple, straight-forward, and extensible...