9 results (0.009 seconds)

CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0

In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting. En System Management Module (SMM), en versiones anteriores a la 1.06, la interfaz web de SMM para cambiar Enclosure VPD falla a la hora de sanear suficientemente todas las entradas para las etiquetas HTML, lo que podría abrir una ruta para Cross-Site Scripting (XSS). • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0

In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows. En System Management Module (SMM), en versiones anteriores a la 1.06, la lógica de creación de certificados y análisis es vulnerable a varios desbordamientos de búfer. • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0

In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection. En System Management Module (SMM), en versiones anteriores a la 1.06, la lógica de creación de certificados y análisis es vulnerable a una inyección de comandos tras la autenticación. • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 5.9EPSS: 0%CPEs: 8EXPL: 0

In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails. En System Management Module (SMM), en versiones anteriores a la 1.06, los registros de SMM hasheaban contraseñas a un registro de depuración cuando la autenticación de usuario fracasa. • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-532: Insertion of Sensitive Information into Log File •

CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0

In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow. En System Management Module (SMM), en versiones anteriores a la 1.06, una función SMM interna que recupera opciones de configuración es propensa a sufrir un desbordamiento de búfer. • https://support.lenovo.com/us/en/solutions/LEN-24374 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •