CVE-2017-3768: Uncontrolled Resource Consumption

An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 Versions earlier than 4.4 for Lenovo System x and earlier than 6.4 for IBM System x. Flooding the IMM2 with a high volume of authentication failures via the Common Information Model CIM used ...

Login information processed by the IMM2 may be exposed to local IMM2 users - us

Lenovo Security Advisory: LEN-14054 Potential Impact: Disclosure of login credentials to user with local privileges Severity: Medium Scope of Impact: Lenovo Specific CVE Identifier: CVE-2017-3744 Summary Description: A risk has been identified in the IMM2 firmware of Lenovo System x servers where...

Login information processed by the IMM2 may be exposed to local IMM2 users - Lenovo Support US

No description provided...

CVE-2017-3744

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

CVE-2017-3744

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

CVE-2017-3744

CVE-2017-3744 affects Lenovo System x IMM2 firmware. Remote commands issued by LXCA/other utilities may be logged in the FFDC service log, potentially exposing clear-text login information to authorized users who can capture/export FFDC data. Impact is confined to Lenovo System x IMM2, with the v...

PT-2017-16078

Name of the Vulnerable Software and Affected Versions Lenovo System x servers affected versions not specified Description The issue concerns the IMM2 firmware of Lenovo System x servers, where remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC...

CVE-2017-3744: Insertion of Sensitive Information into Log File

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

Inherent Risks of Using the Intelligent Platform Management Interface (IPMI) on the Lenovo System x Integrated Management Module (IMM), Integrated Management Module II (IMM2) and ThinkServer TSM - us

Lenovo Security Advisory: LEN-10617 Potential Impact: Access to systems through IPMI if default settings are not changed Severity: High Scope of Impact: Industry-Wide CVE Identifiers: CVE-2013-4037, CVE-2013-4031 Summary Description: Various risks with the industry-standard Intelligent Platform...

Privilege Escalation and Denial of Service Vulnerabilities in System X IMM2

...

CVE-2014-0860

The firmware before 3.66E in IBM BladeCenter Advanced Management Module AMM, the firmware before 1.43 in IBM Integrated Management Module IMM, and the firmware before 4.15 in IBM Integrated Management Module II IMM2 contains cleartext IPMI credentials, which allows attackers to execute arbitrary...

PT-2014-3898

Name of the Vulnerable Software and Affected Versions IBM BladeCenter Advanced Management Module AMM versions prior to 3.66E IBM Integrated Management Module IMM versions prior to 1.43 IBM Integrated Management Module II IMM2 versions prior to 4.15 Description The issue allows attackers to execut...

PT-2013-4801

Name of the Vulnerable Software and Affected Versions Integrated Management Module IMM and Integrated Management Module II IMM2 affected versions not specified Description The issue concerns the Intelligent Platform Management Interface IPMI implementation, which has a default password for the IP...

CVE-2013-4037: Undefined Security Weakness

The RAKP protocol support in the Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers sends a password hash to the client, which makes i...

CVE-2012-4838

IBM Flex System Chassis Management Module CMM and Integrated Management Module 2 IMM2 allow local users to obtain sensitive information about 1 local accounts, 2 SSH private keys, 3 SSL/TLS private keys, 4 SNMPv3 communities, and 5 LDAP credentials by leveraging unspecified side effects of servic...

Code injection

IBM Flex System Chassis Management Module CMM and Integrated Management Module 2 IMM2 allow local users to obtain sensitive information about 1 local accounts, 2 SSH private keys, 3 SSL/TLS private keys, 4 SNMPv3 communities, and 5 LDAP credentials by leveraging unspecified side effects of servic...

CVE-2012-4838

IBM Flex System Chassis Management Module CMM and Integrated Management Module 2 IMM2 allow local users to obtain sensitive information about 1 local accounts, 2 SSH private keys, 3 SSL/TLS private keys, 4 SNMPv3 communities, and 5 LDAP credentials by leveraging unspecified side effects of servic...

CVE-2012-4838

IBM Flex System Chassis Management Module (CMM) and Integrated Management Module 2 (IMM2) are affected by CVE-2012-4838. Public descriptions indicate local users can obtain sensitive information (local accounts, SSH private keys, SSL/TLS private keys, SNMPv3 communities, and LDAP credentials) via...

CVE-2012-4838: Undefined Security Weakness

IBM Flex System Chassis Management Module CMM and Integrated Management Module 2 IMM2 allow local users to obtain sensitive information about 1 local accounts, 2 SSH private keys, 3 SSL/TLS private keys, 4 SNMPv3 communities, and 5 LDAP credentials by leveraging unspecified side effects of servic...

PT-2012-5602

Name of the Vulnerable Software and Affected Versions IBM Flex System Chassis Management Module CMM and Integrated Management Module 2 IMM2 affected versions not specified Description The issue allows local users to obtain sensitive information, including local accounts, SSH private keys, SSL/TLS...