IMM2 FFDC includes Private Key - US

Lenovo Security Advisory: LEN-25667 Potential Impact: Information disclosure Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2019-6157 Summary Description: In Lenovo System x, the integrated management module II IMM2's first failure data capture FFDC includes the web server'...

Code injection

In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...

CVE-2018-16092

In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...

CVE-2018-16092

CVE-2018-16092 affects Lenovo System Management Module (SMM) firmware prior to 1.06. The FFDC feature collects SMM system files, including sensitive data such as SMM user credentials and the system shadow file. This exposure could lead to confidentiality impact if FFDC data is accessed or misused...

CVE-2018-16092 System Management Module Vulnerabilities

In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...

CVE-2018-16092: Undefined Security Weakness

In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...

PT-2018-13405

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns the collection of sensitive information by the FFDC feature in the SMM. This feature collects SMM system files, which include SMM user account credentials and t...

CVE-2018-9068

The CVE-2018-9068 issue affects IBM/Lenovo Integrated Management Module II (IMM2) FFDC data disclosure. In affected IMM2 firmware (Lenovo System x prior to 4.90 and IBM System x prior to 6.80), the SFTP server used for FFDC data access used hard-coded credentials described in the IMM2 documentati...

CVE-2018-9068

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

Integrated Management Module 2 (IMM2) First Failure Data Capture (FFDC) Information Disclosure - US

Lenovo Security Advisory: LEN-20227 Potential Impact: Information disclosure Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2018-9068 Summary Description: The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware...

CVE-2018-9068: Use of Hard-coded Credentials

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

CVE-2017-3744

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

Design/Logic Flaw

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

CVE-2017-3744

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

CVE-2017-3744: Insertion of Sensitive Information into Log File

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

PT-2017-16078

Name of the Vulnerable Software and Affected Versions Lenovo System x servers affected versions not specified Description The issue concerns the IMM2 firmware of Lenovo System x servers, where remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC...

CVE-2017-3744

CVE-2017-3744 affects Lenovo System x IMM2 firmware. Remote commands issued by LXCA/other utilities may be logged in the FFDC service log, potentially exposing clear-text login information to authorized users who can capture/export FFDC data. Impact is confined to Lenovo System x IMM2, with the v...

Default configuration

The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus SIB dump operation involving the First Failure Data Capture FFDC introspection code, which allows local users to...

CVE-2011-5066

The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server WAS 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus SIB dump operation involving the First Failure Data Capture FFDC introspection code, which allows local users to...

CVE-2011-5066

CVE-2011-5066 affects IBM WebSphere Application Server 6.1 (Default Messaging Component). The SibRaRecoverableSiXaResource class does not properly handle a Service Integration Bus (SIB) dump operation in the FFDC introspection code, allowing local users to read the FFDC log file and obtain sensit...