CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-16096 – System Management Module Vulnerabilities
https://notcve.org/view.php?id=CVE-2018-16096
In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting. En System Management Module (SMM), en versiones anteriores a la 1.06, la interfaz web de SMM para cambiar Enclosure VPD falla a la hora de sanear suficientemente todas las entradas para las etiquetas HTML, lo que podría abrir una ruta para Cross-Site Scripting (XSS). • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-16091 – System Management Module Vulnerabilities
https://notcve.org/view.php?id=CVE-2018-16091
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows. En System Management Module (SMM), en versiones anteriores a la 1.06, la lógica de creación de certificados y análisis es vulnerable a varios desbordamientos de búfer. • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2018-16090 – System Management Module Vulnerabilities
https://notcve.org/view.php?id=CVE-2018-16090
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection. En System Management Module (SMM), en versiones anteriores a la 1.06, la lógica de creación de certificados y análisis es vulnerable a una inyección de comandos tras la autenticación. • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.9EPSS: 0%CPEs: 8EXPL: 0CVE-2018-16095 – System Management Module Vulnerabilities
https://notcve.org/view.php?id=CVE-2018-16095
In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails. En System Management Module (SMM), en versiones anteriores a la 1.06, los registros de SMM hasheaban contraseñas a un registro de depuración cuando la autenticación de usuario fracasa. • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2018-16094 – System Management Module Vulnerabilities
https://notcve.org/view.php?id=CVE-2018-16094
In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow. En System Management Module (SMM), en versiones anteriores a la 1.06, una función SMM interna que recupera opciones de configuración es propensa a sufrir un desbordamiento de búfer. • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •