Vulnerabilities > Lenovo
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-08-10 | CVE-2017-3751 | Unquoted Search Path or Element vulnerability in Lenovo Thinkpad Compact USB Keyboard Driver An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0. | 7.2 |
| 2017-08-09 | CVE-2017-3752 | Improper Input Validation vulnerability in multiple products An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches. | 4.3 |
| 2017-07-17 | CVE-2017-3754 | Unspecified vulnerability in Lenovo Bios Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. | 7.2 |
| 2017-07-17 | CVE-2017-3742 | Information Exposure vulnerability in Lenovo Connect2 In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpose of sharing files, the password for this ad-hoc connection will be stored in a user-readable location. | 2.3 |
| 2017-06-29 | CVE-2017-3750 | Unspecified vulnerability in Google Android On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3749. | 6.9 |
| 2017-06-29 | CVE-2017-3749 | Unspecified vulnerability in Google Android On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750. | 6.9 |
| 2017-06-29 | CVE-2017-3748 | Local Privilege Escalation vulnerability in Lenovo VIBE Mobile On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user (commonly known as 'rooting' or "jail breaking" a device). | 7.2 |
| 2017-06-29 | CVE-2017-3747 | Local Privilege Escalation vulnerability in Lenovo Nerve Center Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not affected) that could allow an attacker with local privileges on a system to alter registry keys. | 2.1 |
| 2017-06-20 | CVE-2017-3745 | Improper Authentication vulnerability in Lenovo Xclarity Administrator In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's internal LDAP server, including administrative accounts and service accounts with administrative privileges. | 2.1 |
| 2017-06-20 | CVE-2017-3744 | Information Exposure Through Log Files vulnerability in multiple products In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. | 4.0 |