# cve.now: Lenovo Group Ltd.

The newest entries naming Lenovo Group Ltd. as an affected vendor (up to 200), of 66 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2018-16098](https://cve.now/CVE-2018-16098.md): In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which (no CVSS)
- [CVE-2018-9069](https://cve.now/CVE-2018-9069.md): BIOS Write Protection Race Condition (no CVSS)
- [CVE-2018-9082](https://cve.now/CVE-2018-9082.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS)
- [CVE-2018-9081](https://cve.now/CVE-2018-9081.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS)
- [CVE-2018-9080](https://cve.now/CVE-2018-9080.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS)
- [CVE-2018-9079](https://cve.now/CVE-2018-9079.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS)
- [CVE-2018-9078](https://cve.now/CVE-2018-9078.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS)
- [CVE-2018-9077](https://cve.now/CVE-2018-9077.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS)
- [CVE-2018-9076](https://cve.now/CVE-2018-9076.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS)
- [CVE-2018-9075](https://cve.now/CVE-2018-9075.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS)
- [CVE-2018-9074](https://cve.now/CVE-2018-9074.md): Iomega and LenovoEMC NAS Web UI Vulnerabilities (no CVSS)
- [CVE-2018-9066](https://cve.now/CVE-2018-9066.md): In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additiona (no CVSS)
- [CVE-2018-9065](https://cve.now/CVE-2018-9065.md): In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be a (no CVSS)
- [CVE-2018-9064](https://cve.now/CVE-2018-9064.md): In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the cred (no CVSS)
- [CVE-2018-9068](https://cve.now/CVE-2018-9068.md): The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. (no CVSS)
- [CVE-2018-9062](https://cve.now/CVE-2018-9062.md): BIOS Modules Unprotected by Intel Boot Guard Vulnerable to Physical Attack (no CVSS)
- [CVE-2018-9070](https://cve.now/CVE-2018-9070.md): For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pres (no CVSS)
- [CVE-2018-9067](https://cve.now/CVE-2018-9067.md): The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could h (no CVSS)
- [CVE-2018-9063](https://cve.now/CVE-2018-9063.md): MapDrv (C:\\Program Files\\Lenovo\\System Update\\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerabi (no CVSS)
- [CVE-2017-3775](https://cve.now/CVE-2017-3775.md): Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate sig (no CVSS)
- [CVE-2017-3776](https://cve.now/CVE-2017-3776.md): Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting other (no CVSS)
- [CVE-2017-3774](https://cve.now/CVE-2017-3774.md): A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than ve (no CVSS)
- [CVE-2017-3768](https://cve.now/CVE-2017-3768.md): An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Len (no CVSS)
- [CVE-2017-3762](https://cve.now/CVE-2017-3762.md): Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerp (no CVSS)
- [CVE-2017-3765](https://cve.now/CVE-2017-3765.md): In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "H (no CVSS)
- [CVE-2017-3764](https://cve.now/CVE-2017-3764.md): A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthen (no CVSS)
- [CVE-2017-3767](https://cve.now/CVE-2017-3767.md): A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad p (no CVSS)
- [CVE-2017-3771](https://cve.now/CVE-2017-3771.md): System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without co (no CVSS)
- [CVE-2017-3761](https://cve.now/CVE-2017-3761.md): The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. (no CVSS)
- [CVE-2017-3760](https://cve.now/CVE-2017-3760.md): The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded ap (no CVSS)
- [CVE-2017-3759](https://cve.now/CVE-2017-3759.md): The Lenovo Service Framework Android application accepts some responses from the server without proper validation. (no CVSS)
- [CVE-2017-3758](https://cve.now/CVE-2017-3758.md): Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code ex (no CVSS)
- [CVE-2017-3770](https://cve.now/CVE-2017-3770.md): Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interfac (no CVSS)
- [CVE-2017-3763](https://cve.now/CVE-2017-3763.md): An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts (no CVSS)
- [CVE-2017-3757](https://cve.now/CVE-2017-3757.md): An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand n (no CVSS)
- [CVE-2017-3746](https://cve.now/CVE-2017-3746.md): ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerabili (no CVSS)
- [CVE-2017-3756](https://cve.now/CVE-2017-3756.md): A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. (no CVSS)
- [CVE-2017-3753](https://cve.now/CVE-2017-3753.md): A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (no CVSS)
- [CVE-2017-3751](https://cve.now/CVE-2017-3751.md): An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier t (no CVSS)
- [CVE-2017-3752](https://cve.now/CVE-2017-3752.md): An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on som (no CVSS)
- [CVE-2017-3754](https://cve.now/CVE-2017-3754.md): Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. (no CVSS)
- [CVE-2017-3742](https://cve.now/CVE-2017-3742.md): In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two sy (no CVSS)
- [CVE-2017-3750](https://cve.now/CVE-2017-3750.md): On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bri (no CVSS)
- [CVE-2017-3749](https://cve.now/CVE-2017-3749.md): On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, (no CVSS)
- [CVE-2017-3748](https://cve.now/CVE-2017-3748.md): On Lenovo VIBE mobile phones, improper access controls on the nac\_server component can be abused in conjunction with CVE-2017-3749 and CVE-2 (no CVSS)
- [CVE-2017-3747](https://cve.now/CVE-2017-3747.md): Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not (no CVSS)
- [CVE-2017-3745](https://cve.now/CVE-2017-3745.md): In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to (no CVSS)
- [CVE-2017-3744](https://cve.now/CVE-2017-3744.md): In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data (no CVSS)
- [CVE-2017-3743](https://cve.now/CVE-2017-3743.md): If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Setti (no CVSS)
- [CVE-2017-3741](https://cve.now/CVE-2017-3741.md): In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from funct (no CVSS)
- [CVE-2017-3740](https://cve.now/CVE-2017-3740.md): In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controll (no CVSS)
- [CVE-2016-8231](https://cve.now/CVE-2016-8231.md): In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploite (no CVSS)
- [CVE-2016-8230](https://cve.now/CVE-2016-8230.md): In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model a (no CVSS)
- [CVE-2016-8229](https://cve.now/CVE-2016-8229.md): A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DH (no CVSS)
- [CVE-2016-8228](https://cve.now/CVE-2016-8228.md): In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges. (no CVSS)
- [CVE-2016-8237](https://cve.now/CVE-2016-8237.md): Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code. (no CVSS)
- [CVE-2016-8235](https://cve.now/CVE-2016-8235.md): Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute c (no CVSS)
- [CVE-2016-8236](https://cve.now/CVE-2016-8236.md): Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM ve (no CVSS)
- [CVE-2016-8233](https://cve.now/CVE-2016-8233.md): Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear (no CVSS)
- [CVE-2016-8227](https://cve.now/CVE-2016-8227.md): Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local (no CVSS)
- [CVE-2016-8226](https://cve.now/CVE-2016-8226.md): The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure. (no CVSS)
- [CVE-2016-8225](https://cve.now/CVE-2016-8225.md): Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to exec (no CVSS)
- [CVE-2016-8221](https://cve.now/CVE-2016-8221.md): Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded i (no CVSS)
- [CVE-2016-8222](https://cve.now/CVE-2016-8222.md): A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows (no CVSS)
- [CVE-2016-8224](https://cve.now/CVE-2016-8224.md): A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a sy (no CVSS)
- [CVE-2016-8223](https://cve.now/CVE-2016-8223.md): During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation softw (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/lenovo-group
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.