Lenovo Storcenter PX4-300d Firmware vulnerabilities

5 CVEs affecting Lenovo Storcenter PX4-300d Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-9082, published 2018-09-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-9079, published 2018-09-28. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can…
CVE-2018-9078, published 2018-09-28. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in…
CVE-2018-9080, published 2018-09-28. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not…
CVE-2018-9082, published 2018-09-28. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to…
CVE-2018-9081, published 2018-09-28. Medium severity, CVSS 4.7. EPSS: 0.6% chance of exploitation in the next 30 days. For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site…