CVE-2018-16091: Improper Restriction of Operations within the Bounds of a Memory Buffer

In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows...

CVE-2018-16096: Improper Neutralization of Input During Web Page Generation

In System Management Module SMM versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting...

PT-2018-13405

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns the collection of sensitive information by the FFDC feature in the SMM. This feature collects SMM system files, which include SMM user account credentials and t...

PT-2018-13409

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue is related to the SMM web interface, specifically the part responsible for changing Enclosure VPD. It fails to properly sanitize input for HTML tags, which could lead to...

PT-2018-13404

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue affects the SMM certificate creation and parsing logic, making it susceptible to several buffer overflows. Recommendations For versions prior to 1.06, update to version...

CVE-2018-9084: Undefined Security Weakness

In System Management Module SMM versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented...

CVE-2018-16094: Improper Restriction of Operations within the Bounds of a Memory Buffer

In System Management Module SMM versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow...

PT-2018-13403

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns the SMM certificate creation and parsing logic, which is susceptible to post-authentication command injection. This means that after a user has authenticated, a...

PT-2018-18845

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue allows an attacker who has gained access to the device OS to bypass the validation of software updates. Recommendations For versions prior to 1.06, update to version 1.0...

PT-2018-18844

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns weak default root credentials in the System Management Module SMM. These credentials could potentially be used to log in to the device OS if an attacker...

Lenovo Chassis Management Module (CMM) Information Disclosure Vulnerability (CNVD-2019-05532)

The Lenovo Chassis Management Module CMM is a hot-swappable Lenovo Flex System module that can be used to configure and manage all installed Lenovo Flex System components. An information disclosure vulnerability exists in Lenovo CMM versions prior to 2.0.0, which can be exploited by an attacker t...

Authentication flaw

Lenovo Chassis Management Module CMM prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration...

CVE-2018-9071

Lenovo Chassis Management Module CMM prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration...

CVE-2018-9073

Lenovo Chassis Management Module CMM prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets...

CVE-2018-9071

Lenovo Chassis Management Module CMM prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration...

CVE-2018-9073 CMM Security Vulnerability

Lenovo Chassis Management Module CMM prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets...

CVE-2018-9071 CMM Security Vulnerability

Lenovo Chassis Management Module CMM prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration...

CVE-2018-9071

CVE-2018-9071 affects Lenovo Chassis Management Module (CMM) prior to version 2.0.0, where unauthenticated users can retrieve information about the current authentication configuration, including password length, expiration, and lockout settings. The vulnerability is confirmed across multiple sou...

PT-2018-18832

Name of the Vulnerable Software and Affected Versions Lenovo Chassis Management Module CMM versions prior to 2.0.0 Description The issue allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths,...

CVE-2018-9071: Exposure of Sensitive Information to an Unauthorized Actor

Lenovo Chassis Management Module CMM prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration...