Lenovo Group Ltd. vulnerabilities, page 3
65 vulnerabilities
Known vulnerabilities in Lenovo Group Ltd. products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 46 products.
CVE-2017-3743lenovo group ltd.toolscenter+3
EPSS score0.73%
If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing.CVE-2017-3764lenovo group ltd.xclarity administrator+1EPSS score0.89%
A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed.CVE-2017-3749googleandroid+1EPSS score0.14%
On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750.CVE-2017-3756lenovo group ltd.thinkpad active protection system+74EPSS score0.38%
A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. An attacker with local privileges could execute code with administrative privileges via an unquoted service path.CVE-2017-3762lenovo group ltd.lenovo fingerprint manager pro+1EPSS score0.40%
Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system in which it is installed.CVE-2017-3740lenovo group ltd.active protection system+1EPSS score0.35%
In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controller, which could cause a denial of service attack on the system or the ability to alter hardware functionality.CVE-2017-3751lenovo group ltd.thinkpad compact usb keyboard with trackpoint driver+1EPSS score0.37%
An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0. This could allow an attacker with local privileges to execute code with administrative privileges.CVE-2017-3770lenovo group ltd.lenovo xclarity administrator (lxca)+1EPSS score1.01%
Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interface functionality to execute privileged commands within the underlying LXCA operating system.CVE-2017-3745lenovo group ltd.xclarity administrator+1EPSS score0.40%
In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's internal LDAP server, including administrative accounts and service accounts with administrative privileges. This is an issue only for users who have used local authentication with LXCA and not remote authentication against external LDAP or ADFS servers.CVE-2017-3776lenovo group ltd.help mobile android app+1EPSS score1.09%
Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting others observing the channel to potentially see this information.CVE-2017-3757emcelan_touchpad_driver+1EPSS score0.37%
An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads). This could allow an attacker with local privileges to execute code with administrative privileges.CVE-2017-3759lenovo group ltd.service framework application+1EPSS score1.73%
The Lenovo Service Framework Android application accepts some responses from the server without proper validation. This exposes the application to man-in-the-middle attacks leading to possible remote code execution.CVE-2017-3761lenovo group ltd.service framework application+1EPSS score4.21%
The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead to command injection which, in turn, could lead to remote code execution.CVE-2017-3758lenovo group ltd.service framework application+1EPSS score2.72%
Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code execution.CVE-2017-3742lenovo group ltd.lenovo connect2+1EPSS score0.53%
In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpose of sharing files, the password for this ad-hoc connection will be stored in a user-readable location. An attacker with read access to the user's contents could connect to the Connect2 hotspot and see the contents of files while they are being transferred between the two systems.CVE-2017-3775lenovo group ltd.some lenovo flex system and lenovo system x products+11EPSS score0.27%
Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code.CVE-2017-3767lenovo group ltd.realtek audio driver+1EPSS score0.43%
A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad products. An attacker with local privileges could execute code with administrative privileges.CVE-2017-3774ibmimm2+2EPSS score1.27%
A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in some Lenovo servers and earlier than version 6.60 used in some IBM servers. An attacker providing a crafted user ID and password combination can cause a portion of the authentication routine to overflow its stack, resulting in stack corruption.CVE-2017-3768ibmbladecenter_hs22_firmware+42EPSS score1.21%
An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Lenovo System x and earlier than 6.4 for IBM System x). Flooding the IMM2 with a high volume of authentication failures via the Common Information Model (CIM) used by LXCA and OneCLI and other tools can exhaust available system memory which can cause the IMM2 to reboot itself until the requests cease.CVE-2017-3760lenovo group ltd.service framework application+1EPSS score0.78%
The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded applications and/or data. This exposes the application to man-in-the-middle attacks leading to possible remote code execution.