Lenovo Group Ltd. vulnerabilities
66 CVEs and advisories name Lenovo Group Ltd. as an affected vendor, newest first. Follow it as a feed.
- CVE-2017-3759The Lenovo Service Framework Android application accepts some responses from the server without proper validation.
- CVE-2017-3758Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code ex
- CVE-2017-3770Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interfac
- CVE-2017-3763An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts
- CVE-2017-3757An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand n
- CVE-2017-3746ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerabili
- CVE-2017-3756A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17.
- CVE-2017-3753A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc.
- CVE-2017-3751An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier t
- CVE-2017-3752An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on som
- CVE-2017-3754Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS.
- CVE-2017-3742In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two sy
- CVE-2017-3750On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bri
- CVE-2017-3749On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge,
- CVE-2017-3748On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2
- CVE-2017-3747Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not
- CVE-2017-3745In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to
- CVE-2017-3744In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data
- CVE-2017-3743If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Setti
- CVE-2017-3741In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from funct
- CVE-2017-3740In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controll
- CVE-2016-8231In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploite
- CVE-2016-8230In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model a
- CVE-2016-8229A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DH
- CVE-2016-8228In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges.
- CVE-2016-8237Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.
- CVE-2016-8235Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute c
- CVE-2016-8236Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM ve
- CVE-2016-8233Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear
- CVE-2016-8227Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local