LG
Vendor
Lenovo Group Ltd.
84
CVEs
0
On KEV
0
New 30D
Products
EM9.8
EZ Media and Backup Center
Lenovo Group LTD
9 CVEs0 on KEV0 new
IS9.8
Iomega StorCenter
Lenovo Group LTD
9 CVEs0 on KEV0 new
LE9.8
LenovoEMC
Lenovo Group LTD
9 CVEs0 on KEV0 new
SB8.8
Service Bridge
Lenovo Group Ltd.
4 CVEs0 on KEV0 new
SF9.8
Service Framework application
Lenovo Group Ltd.
4 CVEs0 on KEV0 new
LV7.8
Lenovo Vibe and Lenovo China-only Moto Mobile Phones
Lenovo Group Ltd.
3 CVEs0 on KEV0 new
LX8.8
Lenovo xClarity Administrator
Lenovo Group Ltd.
3 CVEs0 on KEV0 new
XA9.8
xClarity Administrator
Lenovo Group Ltd.
3 CVEs0 on KEV0 new
LX8.8
Lenovo XClarity Administrator (LXCA)
Lenovo Group Ltd.
2 CVEs0 on KEV0 new
AP5.5
Active Protection System
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
AT7.8
All ThinkPad, ThinkCentre, ThinkStation and Lenovo-branded systems preloaded with the Windows 10 operating system, or any system running Lenovo Companion, Lenovo Settings, or Lenovo ID.
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
CC7.8
Customer Care Software Development Kit (CCSDK)
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
DA6.8
Desktop and Notebook BIOS
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
ET7.5
E95, ThinkCentre M710s/M710t
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
EA7.8
Edge and Slim USB Keyboard Driver
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
EN7.0
Enterprise Network Operating System affecting Lenovo and IBM RackSwitch and BladeCenter Products
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
HM7.5
Help mobile Android app
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
ID5.9
IdeaPad
Lenovo Group LTD
1 CVEs0 on KEV0 new
IM9.8
IMM2
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
IM7.5
Integrated Management Module 2 (IMM2)
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LA8.2
Lenovo and IBM Switch Products
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LC4.8
Lenovo Connect2
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LE7.8
Lenovo ElanTech Touchpad driver
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LF7.8
Lenovo Fingerprint Manager Pro
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LH7.5
Lenovo Help Android application
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LN5.5
Lenovo Nerve Center
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LN6.7
Lenovo Notebook BIOS
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LN4.4
Lenovo Notebook models 110-14IBR/110-15IBR, B70-80, E31-80, E40-80, E41-80, E51-80, G40-80, G50-80, G50-80 Touch, Ideapad 300-14IBR/300-15IBR, Ideapad 300-14ISK/300-15ISK/300-17ISK, Ideapad 510S-12ISK, K21-80, K41-80, MIIX 710-12IKB , XiaoXin Air 12, YOGA 510-14ISK/510-15ISK, YOGA 710-11IKB, Yoga 71
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LS6.4
Lenovo Smart Assistant
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LS7.8
Lenovo System Update
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LS6.5
Lenovo System x IMM2
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
LU8.1
Lenovo Updates
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
PM3.3
Power Management Driver
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
RA7.8
Realtek Audio Driver
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
SL6.4
Some Lenovo Flex System and Lenovo System x products
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
SL6.8
some Lenovo ThinkPads
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
SX7.5
System x IMM2
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
SX4.9
System X M5, M6, and X6 BIOS
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
TA7.8
ThinkPad Active Protection System
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
TC7.8
ThinkPad Compact USB Keyboard with TrackPoint Driver
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
TS4.4
ThinkPad systems
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
TU7.8
ThinkPad USB 3.0 Ethernet Adapter Driver
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
TR7.5
ThinkServer RD350, RD450, RD550, RD650, TD350
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
TO7.5
ToolsCenter
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
TA7.8
Transition application
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
VT7.8
Various ThinkPad products
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
XA7.0
XClarity Administrator (LXCA)
Lenovo Group Ltd.
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2018-16098 | VT Various ThinkPad products Lenovo Group Ltd. | 7.8 | Jan 24 | In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution… |
| CVE-2018-9069 | ID IdeaPad Lenovo Group LTD | 5.9 | Oct 2 | BIOS Write Protection Race Condition |
| CVE-2018-9081 | EM EZ Media and Backup Center Lenovo Group LTD | 4.7 | Sep 28 | Iomega and LenovoEMC NAS Web UI Vulnerabilities |
| CVE-2018-9080 | EM EZ Media and Backup Center Lenovo Group LTD | 5.9 | Sep 28 | Iomega and LenovoEMC NAS Web UI Vulnerabilities |
| CVE-2018-9079 | EM EZ Media and Backup Center Lenovo Group LTD | 9.8 | Sep 28 | Iomega and LenovoEMC NAS Web UI Vulnerabilities |
| CVE-2018-9078 | LE LenovoEMC Lenovo Group LTD | 8.8 | Sep 28 | Iomega and LenovoEMC NAS Web UI Vulnerabilities |
| CVE-2018-9077 | LE LenovoEMC Lenovo Group LTD | 8.1 | Sep 28 | Iomega and LenovoEMC NAS Web UI Vulnerabilities |
| CVE-2018-9076 | EM EZ Media and Backup Center Lenovo Group LTD | 8.1 | Sep 28 | Iomega and LenovoEMC NAS Web UI Vulnerabilities |
| CVE-2018-9074 | EM EZ Media and Backup Center Lenovo Group LTD | 6.5 | Sep 28 | Iomega and LenovoEMC NAS Web UI Vulnerabilities |
| CVE-2018-9075 | LE LenovoEMC Lenovo Group LTD | 8.1 | Sep 28 | Iomega and LenovoEMC NAS Web UI Vulnerabilities |
| CVE-2018-9082 | EM EZ Media and Backup Center Lenovo Group LTD | 8.8 | Sep 28 | Iomega and LenovoEMC NAS Web UI Vulnerabilities |
| CVE-2018-9064 | LX Lenovo xClarity Administrator Lenovo Group Ltd. | 8.8 | Jul 30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user |
| CVE-2018-9066 | LX Lenovo xClarity Administrator Lenovo Group Ltd. | 8.8 | Jul 30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API… |
| CVE-2018-9065 | LX Lenovo xClarity Administrator Lenovo Group Ltd. | 7.5 | Jul 30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store… |
| CVE-2018-9068 | SX System x IMM2 Lenovo Group Ltd. | 7.5 | Jul 26 | The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected |
| CVE-2018-9062 | SL some Lenovo ThinkPads Lenovo Group Ltd. | 6.8 | Jul 19 | BIOS Modules Unprotected by Intel Boot Guard Vulnerable to Physical Attack |
| CVE-2018-9070 | LS Lenovo Smart Assistant Lenovo Group Ltd. | 6.4 | Jul 13 | For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter… |
| CVE-2018-9067 | LH Lenovo Help Android application Lenovo Group Ltd. | 7.5 | Jul 13 | The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could have led to exposure of approximately… |
| CVE-2018-9063 | LS Lenovo System Update Lenovo Group Ltd. | 7.8 | May 4 | MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very… |
| CVE-2017-3775 | SL Some Lenovo Flex System and Lenovo System x products Lenovo Group Ltd. | 6.4 | May 4 | Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it |
| CVE-2017-3774 | IM IMM2 Lenovo Group Ltd. | 9.8 | Apr 19 | A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in some Lenovo servers… |
| CVE-2017-3776 | HM Help mobile Android app Lenovo Group Ltd. | 7.5 | Apr 19 | Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting others observing the channel to potentially… |
| CVE-2017-3768 | IM Integrated Management Module 2 (IMM2) Lenovo Group Ltd. | 7.5 | Jan 26 | An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Lenovo System x and earlier than 6.4 for… |
| CVE-2017-3762 | LF Lenovo Fingerprint Manager Pro Lenovo Group Ltd. | 7.8 | Jan 26 | Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encrypted using a weak… |
| CVE-2017-3765 | EN Enterprise Network Operating System affecting Lenovo and IBM RackSwitch and BladeCenter Products Lenovo Group Ltd. | 7.0 | Jan 10 | In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a… |
| CVE-2017-3764 | XA xClarity Administrator Lenovo Group Ltd. | 5.3 | Nov 30 | A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA… |
| CVE-2017-3767 | RA Realtek Audio Driver Lenovo Group Ltd. | 7.8 | Nov 13 | A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad products |
| CVE-2017-3771 | ET E95, ThinkCentre M710s/M710t Lenovo Group Ltd. | 7.5 | Oct 26 | System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without completing BIOS/UEFI initialization… |
| CVE-2017-3759 | SF Service Framework application Lenovo Group Ltd. | 8.1 | Oct 17 | The Lenovo Service Framework Android application accepts some responses from the server without proper validation |
| CVE-2017-3761 | SF Service Framework application Lenovo Group Ltd. | 9.8 | Oct 17 | The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input |
| CVE-2017-3760 | SF Service Framework application Lenovo Group Ltd. | 8.1 | Oct 17 | The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded applications and/or data |
| CVE-2017-3758 | SF Service Framework application Lenovo Group Ltd. | 9.8 | Oct 17 | Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code execution |
| CVE-2017-3770 | LX Lenovo XClarity Administrator (LXCA) Lenovo Group Ltd. | 8.8 | Sep 22 | Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interface functionality to execute privileged… |
| CVE-2017-3763 | LX Lenovo XClarity Administrator (LXCA) Lenovo Group Ltd. | 6.7 | Sep 22 | An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts in LXCA versions earlier than 1.3.2 |
| CVE-2017-3757 | LE Lenovo ElanTech Touchpad driver Lenovo Group Ltd. | 7.8 | Aug 28 | An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads) |
| CVE-2017-3746 | TU ThinkPad USB 3.0 Ethernet Adapter Driver Lenovo Group Ltd. | 7.8 | Aug 28 | ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerability that could allow a local user to… |
| CVE-2017-3756 | TA ThinkPad Active Protection System Lenovo Group Ltd. | 7.8 | Aug 18 | A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17 |
| CVE-2017-3753 | DA Desktop and Notebook BIOS Lenovo Group Ltd. | 6.8 | Aug 10 | A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc |
| CVE-2017-3751 | TC ThinkPad Compact USB Keyboard with TrackPoint Driver Lenovo Group Ltd. | 7.8 | Aug 10 | An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0 |
| CVE-2017-3752 | LA Lenovo and IBM Switch Products Lenovo Group Ltd. | 8.2 | Aug 9 | An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches |
| CVE-2017-3754 | LN Lenovo Notebook BIOS Lenovo Group Ltd. | 6.7 | Jul 17 | Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS |
| CVE-2017-3742 | LC Lenovo Connect2 Lenovo Group Ltd. | 4.8 | Jul 17 | In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpose of sharing files,… |
| CVE-2017-3748 | LV Lenovo Vibe and Lenovo China-only Moto Mobile Phones Lenovo Group Ltd. | 7.8 | Jun 29 | On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the… |
| CVE-2017-3750 | LV Lenovo Vibe and Lenovo China-only Moto Mobile Phones Lenovo Group Ltd. | 6.4 | Jun 29 | On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to… |
| CVE-2017-3749 | LV Lenovo Vibe and Lenovo China-only Moto Mobile Phones Lenovo Group Ltd. | 6.4 | Jun 29 | On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to… |
| CVE-2017-3747 | LN Lenovo Nerve Center Lenovo Group Ltd. | 5.5 | Jun 29 | Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not affected) that could allow an attacker… |
| CVE-2017-3744 | LS Lenovo System x IMM2 Lenovo Group Ltd. | 6.5 | Jun 20 | In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the… |
| CVE-2017-3745 | XA XClarity Administrator Lenovo Group Ltd. | 7.8 | Jun 20 | In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that… |
| CVE-2017-3743 | TO ToolsCenter Lenovo Group Ltd. | 7.5 | Jun 20 | If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System… |
| CVE-2016-8229 | SB Service Bridge Lenovo Group Ltd. | 8.8 | Jun 3 | A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DHCP server used by the system where LSB… |
| CVE-2017-3741 | PM Power Management Driver Lenovo Group Ltd. | 3.3 | Jun 3 | In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly |
| CVE-2017-3740 | AP Active Protection System Lenovo Group Ltd. | 5.5 | Jun 3 | In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controller, which could cause a denial of… |
| CVE-2016-8231 | SB Service Bridge Lenovo Group Ltd. | 7.5 | Jun 3 | In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged… |
| CVE-2016-8230 | SB Service Bridge Lenovo Group Ltd. | 7.5 | Jun 3 | In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model and product name to Lenovo's servers |
| CVE-2016-8228 | SB Service Bridge Lenovo Group Ltd. | 7.8 | Jun 3 | In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges |
| CVE-2016-8237 | LU Lenovo Updates Lenovo Group Ltd. | 8.1 | Apr 10 | Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code |
| CVE-2016-8235 | CC Customer Care Software Development Kit (CCSDK) Lenovo Group Ltd. | 7.8 | Apr 10 | Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute code with elevated privileges |
| CVE-2016-8236 | TR ThinkServer RD350, RD450, RD550, RD650, TD350 Lenovo Group Ltd. | 7.5 | Mar 3 | Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM versions earlier than 3.77 |
| CVE-2016-8233 | XA XClarity Administrator Lenovo Group Ltd. | 9.8 | Mar 1 | Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that could be viewed by a… |
| CVE-2016-8226 | SX System X M5, M6, and X6 BIOS Lenovo Group Ltd. | 4.9 | Jan 26 | The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure |