Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2018-11-27	CVE-2018-9084	Unspecified vulnerability in Lenovo System Management Module Firmware 1.05 In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented. network low complexity lenovo	6.5
2018-11-27	CVE-2018-16096	Cross-site Scripting vulnerability in Lenovo System Management Module Firmware 1.05 In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting. network low complexity lenovo CWE-79	6.1
2018-11-27	CVE-2018-16095	Information Exposure Through Log Files vulnerability in Lenovo System Management Module Firmware 1.05 In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails. network high complexity lenovo CWE-532	5.9