Lenovo vulnerabilities, page 5
529 vulnerabilities
Known vulnerabilities in Lenovo products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3,161 products.
HighCVE-2021-3462lenovo · power_management_driver +1 morelenovo power_management_driverA privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the driver's device object.EPSS0.20%HighCVE-2021-3550lenovo · pcmanagerlenovo pcmanagerA DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.500.5102, that could allow privilege escalation.EPSS0.25%MediumCVE-2021-3473lenovo · xclarity_controller +1 morelenovo xclarity_controllerAn internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.EPSS0.48%MediumCVE-2021-3956lenovo · xclarity_controller +1 morelenovo xclarity_controllerA read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. XCC devices configured to use local authentication, LDAP Authentication + Authorization Mode, or LDAP servers that support only “authenticated bind” and/or “anonymous bind” are not affected.EPSS0.79%HighCVE-2021-3840antilles +2 moreantilles antillesA dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles, removing all other public package indexes. Additionally, the antilles-tools dependency has been published to PyPi.EPSS2.04%MediumCVE-2015-2234lenovo · system_updatelenovo system_updateRace condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated.EPSS0.27%HighCVE-2015-2233lenovo · system_updatelenovo system_updateLenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate.EPSS0.40%HighCVE-2015-2219lenovo · system_updatelenovo system_updateLenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.EPSS4.15%HighCVE-2015-4596lenovo · mouse_suitelenovo mouse_suiteLenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges.EPSS0.30%HighCVE-2015-7818ibm · system_networking_switch_center +1 moreibm system_networking_switch_centerThe administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file.EPSS0.43%HighCVE-2015-7333lenovo · system_updatelenovo system_updateMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type INF and INF_BY_COMPATIBLE_ID command types could allow a user to execute arbitrary code with elevated privileges.EPSS0.35%HighCVE-2015-7334lenovo · system_updatelenovo system_updateMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type COMMAND type could allow a user to execute arbitrary code with elevated privileges.EPSS0.36%MediumCVE-2015-7819ibm · system_networking_switch_center +1 moreibm system_networking_switch_centerThe DB service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain sensitive administrator-account information via a request on port 40999, as demonstrated by an improperly encrypted password.EPSS1.32%HighCVE-2015-7817ibm · system_networking_switch_center +1 moreibm system_networking_switch_centerRace condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide FileReader.jsp input containing directory traversal sequences to read arbitrary text files, via a request to port 40080 or 40443.EPSS1.41%HighCVE-2015-7820ibm · system_networking_switch_center +1 moreibm system_networking_switch_centerRace condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide ZipDownload.jsp input containing directory traversal sequences to read arbitrary files, via a request to port 40080 or 40443.EPSS1.41%HighCVE-2015-7335lenovo · system_updatelenovo system_updateMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow a user to execute arbitrary code with elevated privileges.EPSS0.23%HighCVE-2015-7336lenovo · system_updatelenovo system_updateMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed.EPSS0.59%CriticalCVE-2015-5684lenovo · b50-10_firmware +26 morelenovo b50-10_firmwareMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system.EPSS3.69%HighCVE-2015-6971lenovo · system_updatelenovo system_updateLenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges by launching signed Lenovo executables.EPSS0.47%HighCVE-2015-8535lenovo · solution_centerlenovo solution_centerMITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.EPSS0.76%