Lenovo Group Ltd.
56 CVEs across 43 Lenovo Group Ltd. products. Browse Lenovo Group Ltd. vulnerabilities, severities, and proof-of-concept exploits.
Lenovo Group Ltd. products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-16098 | High | 7.8 | 2019-01-24 | In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unautho… |
CVE-2018-9066 | High | 8.8 | 2018-07-30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a… |
CVE-2018-9065 | High | 7.5 | 2018-07-30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a c… |
CVE-2018-9064 | High | 8.8 | 2018-07-30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the Sys… |
CVE-2018-9068 | High | 7.5 | 2018-07-26 | The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is… |
CVE-2018-9062 | Medium | 6.8 | 2018-07-19 | In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code. |
CVE-2018-9070 | Medium | 6.4 | 2018-07-13 | For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific but… |
CVE-2018-9067 | High | 7.5 | 2018-07-13 | The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could have led to exposure… |
CVE-2018-9063 | High | 7.8 | 2018-05-04 | MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attac… |
CVE-2017-3775 | Medium | 6.4 | 2018-05-04 | Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before boo… |
CVE-2017-3776 | High | 7.5 | 2018-04-19 | Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting others observing the cha… |
CVE-2017-3774 | Critical | 9.8 | 2018-04-19 | A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in… |
CVE-2017-3768 | High | 7.5 | 2018-01-26 | An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Lenovo System x and ea… |
CVE-2017-3762 | High | 7.8 | 2018-01-26 | Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encry… |
CVE-2017-3765 | High | 7.0 | 2018-01-10 | In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was dis… |
CVE-2017-3764 | Medium | 5.3 | 2017-11-30 | A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with… |
CVE-2017-3767 | High | 7.8 | 2017-11-13 | A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad products. An attacke… |
CVE-2017-3771 | High | 7.5 | 2017-10-26 | System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without completing BIOS/UEFI… |
CVE-2017-3761 | Critical | 9.8 | 2017-10-17 | The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead… |
CVE-2017-3760 | High | 8.1 | 2017-10-17 | The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded applications and/or d… |
CVE-2017-3759 | High | 8.1 | 2017-10-17 | The Lenovo Service Framework Android application accepts some responses from the server without proper validation. This exposes the application to man-in-the-m… |
CVE-2017-3758 | Critical | 9.8 | 2017-10-17 | Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code execution. |
CVE-2017-3770 | High | 8.8 | 2017-09-22 | Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interface functionality to… |
CVE-2017-3763 | Medium | 6.7 | 2017-09-22 | An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts in LXCA versions e… |
CVE-2017-3757 | High | 7.8 | 2017-08-29 | An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not Think… |
CVE-2017-3746 | High | 7.8 | 2017-08-29 | ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerability that could allow… |
CVE-2017-3756 | High | 7.8 | 2017-08-18 | A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. An attacker with l… |
CVE-2017-3753 | Medium | 6.8 | 2017-08-10 | A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, co… |
CVE-2017-3751 | High | 7.8 | 2017-08-10 | An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0. This c… |
CVE-2017-3752 | High | 8.2 | 2017-08-09 | An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches… |
CVE-2017-3754 | Medium | 6.7 | 2017-07-17 | Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or adminis… |
CVE-2017-3742 | Medium | 4.8 | 2017-07-17 | In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpo… |
CVE-2017-3750 | Medium | 6.4 | 2017-06-29 | On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bridge, which allows t… |
CVE-2017-3749 | Medium | 6.4 | 2017-06-29 | On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampe… |
CVE-2017-3748 | High | 7.8 | 2017-06-29 | On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate… |
CVE-2017-3747 | Medium | 5.5 | 2017-06-29 | Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not affected) that cou… |
CVE-2017-3745 | High | 7.8 | 2017-06-20 | In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password informatio… |
CVE-2017-3744 | Medium | 6.5 | 2017-06-20 | In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) ser… |
CVE-2017-3743 | High | 7.5 | 2017-06-20 | If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU)… |
CVE-2017-3741 | Low | 3.3 | 2017-06-04 | In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly. T… |
CVE-2017-3740 | Medium | 5.5 | 2017-06-04 | In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controller, which could cau… |
CVE-2016-8231 | High | 7.5 | 2017-06-04 | In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to… |
CVE-2016-8230 | High | 7.5 | 2017-06-04 | In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model and product name to… |
CVE-2016-8229 | High | 8.8 | 2017-06-04 | A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DHCP server used by t… |
CVE-2016-8228 | High | 7.8 | 2017-06-04 | In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges. |
CVE-2016-8237 | High | 8.1 | 2017-04-10 | Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code. |
CVE-2016-8235 | High | 7.8 | 2017-04-10 | Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute code with elevated p… |
CVE-2016-8236 | High | 7.5 | 2017-03-03 | Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM versions earlier than… |
CVE-2016-8233 | Critical | 9.8 | 2017-03-01 | Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that coul… |
CVE-2016-8227 | High | 7.8 | 2017-01-26 | Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local users to execute co… |
CVE-2016-8226 | Medium | 4.9 | 2017-01-26 | The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure. |
CVE-2016-8225 | High | 7.8 | 2017-01-26 | Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to execute code with eleva… |
CVE-2016-8221 | High | 7.0 | 2017-01-12 | Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules… |
CVE-2016-8222 | Medium | 4.4 | 2016-11-30 | A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level… |
CVE-2016-8224 | Medium | 4.4 | 2016-11-29 | A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install… |
CVE-2016-8223 | High | 7.8 | 2016-11-29 | During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation software installed on so… |