CVSS: 6.9EPSS: 0%CPEs: 38EXPL: 0CVE-2020-8332
https://notcve.org/view.php?id=CVE-2020-8332
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected. Una potencial vulnerabilidad en la devolución de llamada de la función SMI utilizada en los controladores USB del modo BIOS heredado en algunos servidores Lenovo e IBM System x heredados puede permitir una ejecución de código arbitraria. Los servidores que funcionan en modo UEFI no están afectados • https://support.lenovo.com/us/en/product_security/LEN-38625 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2019-6157
https://notcve.org/view.php?id=CVE-2019-6157
In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support. En varias versiones de firmware de Lenovo System x, First Failure Data Capture (FFDC) del módulo de administración integrada II (IMM2) incluye la clave privada del servidor web dentro del archivo de registro generado para soporte. • https://support.lenovo.com/solutions/LEN-25667 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 4.9EPSS: 0%CPEs: 58EXPL: 0CVE-2018-9085 – Missing System x Flash Memory Write Protection Lock Bit
https://notcve.org/view.php?id=CVE-2018-9085
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors. Se ha dejado sin establecer un bit de bloqueo de protección de escritura tras el arranque en una generación más antigua de los servidores x de Lenovo y IBM System, lo que podría permitir que un atacante con acceso de administrador modifique el subconjunto de memoria flash que contiene Intel SPS (Server Platform Services) y los descriptores flash del sistema. • https://support.lenovo.com/us/en/solutions/LEN-24477 • CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 0%CPEs: 84EXPL: 0CVE-2018-9068
https://notcve.org/view.php?id=CVE-2018-9068
The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI. La función IMM2 First Failure Data Capture recopila información de diagnóstico y registros de los módulos de gestión cuando se detecta un error de hardware. • https://support.lenovo.com/us/en/solutions/LEN-20227 • CWE-798: Use of Hard-coded Credentials •
CVSS: 6.5EPSS: 0%CPEs: 47EXPL: 0CVE-2017-3744
https://notcve.org/view.php?id=CVE-2017-3744
In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands. En el firmware IMM2 de los servidores Lenovo System x, los comandos remotos enviados por LXCA u otras utilidades pueden ser capturados en el registro del servicio First Failure Data Capture (FFDC) si el registro del servicio se genera cuando ese comando remoto está en ejecución. Los datos de comando capturados podrían contener información de inicio de sesión en texto claro. • https://support.lenovo.com/product_security/LEN-14054 • CWE-532: Insertion of Sensitive Information into Log File •