CVSS: 9.8EPSS: 0%CPEs: 67EXPL: 0CVE-2017-17833 – openslp: Heap memory corruption in slpd/slpd_process.c allows denial of service or potentially code execution
https://notcve.org/view.php?id=CVE-2017-17833
OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability. Las versiones de OpenSLP en las secuencias de código 1.0.2 y 1.1.0 tienen un problema de corrupción de memoria relacionada con la memoria dinámica (heap), que puede manifestarse como una vulnerabilidad de denegación de servicio (DoS) o de ejecución remota de código. A use-after-free flaw in OpenSLP 1.x and 2.x baselines was discovered in the ProcessSrvRqst function. A failure to update a local pointer may lead to heap corruption. A remote attacker may be able to leverage this flaw to gain remote code execution. • http://support.lenovo.com/us/en/solutions/LEN-18247 https://access.redhat.com/errata/RHSA-2018:2240 https://access.redhat.com/errata/RHSA-2018:2308 https://lists.debian.org/debian-lts-announce/2018/04/msg00029.html https://security.gentoo.org/glsa/202005-12 https://sourceforge.net/p/openslp/mercurial/ci/151f07745901cbdba6e00e4889561b4083250da1 https://usn.ubuntu.com/3708-1 https://access.redhat.com/security/cve/CVE-2017-17833 https://bugzilla.redhat.com/show_bug.cgi?id=1572166 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416: Use After Free •
CVSS: 7.2EPSS: 0%CPEs: 222EXPL: 0CVE-2017-3753
https://notcve.org/view.php?id=CVE-2017-3753
A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V. Se ha identificado una vulnerabilidad en algunos productos Lenovo que emplean código UEFI (BIOS) desarrollado por American Megatrends, Inc. (AMI). • https://support.lenovo.com/us/en/product_security/LEN-14695 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2016-8236
https://notcve.org/view.php?id=CVE-2016-8236
Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM versions earlier than 3.77. El reestablecimiento de la configuración predeterminada puede ocurrir en Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 durante una tormenta de difusión prolongada en versiones TSM anteriores a 3.77. • https://support.lenovo.com/us/en/solutions/LEN-9307 • CWE-284: Improper Access Control •
CVSS: 5.9EPSS: 1%CPEs: 60EXPL: 0CVE-2016-8106
https://notcve.org/view.php?id=CVE-2016-8106
A Denial of Service in Intel Ethernet Controller's X710/XL710 with Non-Volatile Memory Images before version 5.05 allows a remote attacker to stop the controller from processing network traffic working under certain network use conditions. Una denegación de servicio en Intel Ethernet Controller's X710/XL710 con Non-Volatile Memory Images en versiones anteriores a 5.05 permite a atacantes remotos detener el controlador de procesar el tráfico de red que funciona bajo determinadas condiciones de uso de la red. • http://www-01.ibm.com/support/docview.wss?uid=swg22002507 http://www.securityfocus.com/bid/95333 http://www.securitytracker.com/id/1037562 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05368378 https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00063&languageid=en-fr https://security.netapp.com/advisory/ntap-20190731-0001 https://support.lenovo.com/us/en/product_security/LEN-12029 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0CVE-2015-3324
https://notcve.org/view.php?id=CVE-2015-3324
The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 does not validate server certificates during an "encrypted remote KVM session," which allows man-in-the-middle attackers to spoof servers. ThinkServer System Manager (TSM) Baseboard Management Controller anterior a firmware 1.27.73476 para ThinkServer RD350, RD450, RD550, RD650, y TD350 no valida los certificados de servidores durante una 'sesión KVM remota codificada,' lo que permite a atacantes man-in-the-middle falsificar servidores. • http://support.lenovo.com/us/en/product_security/tsm_weak_pw http://www.securityfocus.com/bid/74199 • CWE-310: Cryptographic Issues •