Lenovo Group Ltd. vulnerabilities
65 vulnerabilities
Known vulnerabilities in Lenovo Group Ltd. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 46 products.
Products
46- EZ Media And Backup Center9 vulnerabilities
- Iomega Storcenter9 vulnerabilities
- Lenovoemc9 vulnerabilities
- Service Bridge4 vulnerabilities
- Service Framework Application4 vulnerabilities
- Lenovo Vibe And Lenovo China Only Moto Mobile Phones3 vulnerabilities
- Lenovo Xclarity Administrator3 vulnerabilities
- Xclarity Administrator3 vulnerabilities
- Lenovo Xclarity Administrator (Lxca)2 vulnerabilities
- Active Protection System1 vulnerabilities
- All Thinkpad, Thinkcentre, Thinkstation And Lenovo Branded Systems Preloaded With The Windows 10 Operating System, Or Any System Running Lenovo Companion, Lenovo Settings, Or Lenovo ID.1 vulnerabilities
- Customer Care Software Development Kit (Ccsdk)1 vulnerabilities
- Desktop And Notebook1 vulnerabilities
- E95, Thinkcentre M710S/M710T1 vulnerabilities
- Edge And Slim USB Keyboard Driver1 vulnerabilities
- Enterprise Network Operating System Affecting Lenovo And IBM Rackswitch And Bladecenter Products1 vulnerabilities
- Help Mobile Android App1 vulnerabilities
- Ideapad1 vulnerabilities
- IMM21 vulnerabilities
- Integrated Management Module 2 (Imm2)1 vulnerabilities
- Lenovo And IBM Switch Products1 vulnerabilities
- Lenovo Connect21 vulnerabilities
- Lenovo Elantech Touchpad Driver1 vulnerabilities
- Lenovo Fingerprint Manager Pro1 vulnerabilities
- Lenovo Help Android Application1 vulnerabilities
- Lenovo Nerve Center1 vulnerabilities
- Lenovo Notebook1 vulnerabilities
- Lenovo Smart Assistant1 vulnerabilities
- Lenovo System Update1 vulnerabilities
- Lenovo System X IMM21 vulnerabilities
- Lenovo Updates1 vulnerabilities
- Power Management Driver1 vulnerabilities
- Realtek Audio Driver1 vulnerabilities
- Some Lenovo Flex System And Lenovo System X Products1 vulnerabilities
- Some Lenovo Thinkpads1 vulnerabilities
- System X IMM21 vulnerabilities
- System X M5, M6, And X61 vulnerabilities
- Thinkpad Active Protection System1 vulnerabilities
- Thinkpad Compact USB Keyboard With Trackpoint Driver1 vulnerabilities
- Thinkpad Systems1 vulnerabilities
- Thinkpad USB 3.0 Ethernet Adapter Driver1 vulnerabilities
- Thinkserver Rd350, Rd450, Rd550, Rd650, Td3501 vulnerabilities
- Toolscenter1 vulnerabilities
- Transition Application1 vulnerabilities
- Various Thinkpad Products1 vulnerabilities
- Xclarity Administrator (Lxca)1 vulnerabilities
CVE-2018-16098lenovo group ltd.various thinkpad products+59
EPSS score0.40%
In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.CVE-2018-9082lenovo group ltdez media and backup center+22EPSS score0.72%
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's accountCVE-2018-9075lenovo group ltdez media and backup center+3EPSS score4.08%
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injection payload using backtick "``" characters in the client:password parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.CVE-2018-9077lenovo group ltdez media and backup center+3EPSS score1.62%
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the share : name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.CVE-2018-9081lenovo group ltdez media and backup center+22EPSS score0.55%
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger.CVE-2018-9064lenovo group ltd.lenovo xclarity administrator+1EPSS score0.96%
In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user.CVE-2018-9076lenovo group ltdez media and backup center+3EPSS score1.62%
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.CVE-2018-9078lenovo group ltdez media and backup center+22EPSS score1.04%
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file.CVE-2018-9070lenovo group ltd.lenovo smart assistant+1EPSS score0.29%
For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides extra privileges, including changing settings and running code. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo.CVE-2018-9074lenovo group ltdez media and backup center+3EPSS score0.97%
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user.CVE-2018-9062lenovo group ltd.some lenovo thinkpads+39EPSS score0.53%
In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.CVE-2018-9067lenovo group ltd.lenovo help android application+1EPSS score1.11%
The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could have led to exposure of approximately 400 email addresses and 8,500 IMEI.CVE-2018-9065lenovo group ltd.lenovo xclarity administrator+1EPSS score0.46%
In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and potentially decrypt those credentials more easily than intended.CVE-2018-9066lenovo group ltd.lenovo xclarity administrator+1EPSS score2.24%
In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged command execution within LXCA's underlying operating system.CVE-2018-9080lenovo group ltdez media and backup center+22EPSS score0.73%
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.CVE-2018-9069hp310s-14isk_firmware+68EPSS score0.53%
In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.CVE-2018-9079lenovo group ltdez media and backup center+22EPSS score1.23%
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the origin of the device.CVE-2018-9063lenovo group ltd.lenovo system update+1EPSS score0.38%
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or password can overrun the program's buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv.CVE-2018-9068ibm corporationsystem x imm2+43EPSS score1.05%
The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI.CVE-2016-8229lenovo group ltd.service bridge+1EPSS score0.45%
A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DHCP server used by the system where LSB is installed.