Lenovo Thinkagile Hx Enclosure 7y87
9 CVEs affecting Lenovo Thinkagile Hx Enclosure 7y87. Latest disclosed: 2018-11-27. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-9083 | High | 8.1 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if t… |
CVE-2018-16094 | High | 8.1 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow. |
CVE-2018-16092 | High | 8.1 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notabl… |
CVE-2018-16091 | High | 8.1 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows. |
CVE-2018-16090 | High | 7.5 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection. |
CVE-2018-16089 | High | 7.5 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authen… |
CVE-2018-9084 | Medium | 6.5 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumve… |
CVE-2018-16096 | Medium | 6.1 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML ta… |
CVE-2018-16095 | Medium | 5.9 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails. |