5 results (0.003 seconds)

CVSS: 6.7EPSS: 0%CPEs: 99EXPL: 0

CVE-2024-45105

https://notcve.org/view.php?id=CVE-2024-45105

13 Sep 2024 — An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code. • https://support.lenovo.com/us/en/product_security/LEN-165524 • CWE-825: Expired Pointer Dereference •

CVSS: 8.3EPSS: 0%CPEs: 139EXPL: 0

CVE-2024-8281

https://notcve.org/view.php?id=CVE-2024-8281

13 Sep 2024 — An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell. • https://support.lenovo.com/us/en/product_security/LEN-172051 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 8.3EPSS: 0%CPEs: 139EXPL: 0

CVE-2024-8280

https://notcve.org/view.php?id=CVE-2024-8280

13 Sep 2024 — An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or cause a recoverable denial of service using a specially crafted file. • https://support.lenovo.com/us/en/product_security/LEN-172051 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 8.3EPSS: 0%CPEs: 139EXPL: 0

CVE-2024-8279

https://notcve.org/view.php?id=CVE-2024-8279

13 Sep 2024 — A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads. • https://support.lenovo.com/us/en/product_security/LEN-172051 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 8.3EPSS: 0%CPEs: 139EXPL: 0

CVE-2024-8278

https://notcve.org/view.php?id=CVE-2024-8278

13 Sep 2024 — A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands. • https://support.lenovo.com/us/en/product_security/LEN-172051 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •