Unspecified vulnerability in Lenovo Intel PRO/1000 LAN adapter before Build 135400, as used on IBM Lenovo ThinkPad systems, has unknown impact and attack vectors.
Max CVSS
10.0
EPSS Score
0.58%
Published
2007-03-07
Updated
2011-03-08
The IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1), does not properly validate digital signatures of downloaded software, which makes it easier for remote attackers to spoof a download.
Max CVSS
5.8
EPSS Score
1.15%
Published
2007-08-15
Updated
2018-10-12
Format string vulnerability in the IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1), allows remote attackers to execute arbitrary code via format string specifiers in unknown data.
Max CVSS
5.8
EPSS Score
13.44%
Published
2007-08-15
Updated
2018-10-12
The IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix pack 1), exposes unsafe methods to arbitrary web domains, which allows remote attackers to download arbitrary code onto a client system and execute this code.
Max CVSS
5.8
EPSS Score
0.98%
Published
2007-08-15
Updated
2018-10-12
The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM.
Max CVSS
5.1
EPSS Score
1.56%
Published
2008-07-21
Updated
2017-08-08
Heap-based buffer overflow in the tvtumin.sys kernel driver in Lenovo Rescue and Recovery 4.20, including 4.20.0511 and 4.20.0512, allows local users to execute arbitrary code via a long file name.
Max CVSS
7.2
EPSS Score
0.04%
Published
2008-10-15
Updated
2018-10-11
Lenovo Veriface III allows physically proximate attackers to login to a Windows account by presenting a "plain image" of the authorized user.
Max CVSS
6.9
EPSS Score
0.10%
Published
2009-02-20
Updated
2017-08-17
Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate Software 6.4.0.2900 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as a file that is processed by Lenovo Bluetooth.
Max CVSS
9.3
EPSS Score
0.91%
Published
2014-01-21
Updated
2017-08-29
java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of the SearchBoxImpl class, which allows attackers to execute arbitrary Java code by leveraging access to the searchBoxJavaBridge_ interface at certain Android API levels.
Max CVSS
7.5
EPSS Score
0.16%
Published
2014-03-03
Updated
2016-05-26

CVE-2015-2219

Public exploit
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.
Max CVSS
7.2
EPSS Score
0.09%
Published
2015-05-12
Updated
2016-12-03
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate.
Max CVSS
8.3
EPSS Score
0.05%
Published
2015-05-12
Updated
2016-12-03
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated.
Max CVSS
6.9
EPSS Score
0.04%
Published
2015-05-12
Updated
2017-01-03
The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
Max CVSS
6.9
EPSS Score
0.09%
Published
2015-08-31
Updated
2023-02-13
Lenovo USB Enhanced Performance Keyboard software before 2.0.2.2 includes active debugging code in SKHOOKS.DLL, which allows local users to obtain keypress information by accessing debug output.
Max CVSS
2.1
EPSS Score
0.04%
Published
2015-04-16
Updated
2017-01-18
Services and files in Lenovo Fingerprint Manager before 8.01.42 have incorrect ACLs, which allows local users to invalidate local checks and gain privileges via standard filesystem operations.
Max CVSS
7.2
EPSS Score
0.04%
Published
2017-10-03
Updated
2017-10-17
Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 servers before 1.26.0 use weak encryption to store (1) user and (2) administrator BIOS passwords, which allows attackers to decrypt the passwords via unspecified vectors.
Max CVSS
5.0
EPSS Score
0.08%
Published
2015-04-16
Updated
2017-01-18
The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 allows remote attackers to cause a denial of service (web interface crash) via a malformed HTTP request during authentication.
Max CVSS
5.0
EPSS Score
0.30%
Published
2015-04-16
Updated
2016-12-06
The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 does not validate server certificates during an "encrypted remote KVM session," which allows man-in-the-middle attackers to spoof servers.
Max CVSS
4.3
EPSS Score
0.05%
Published
2015-04-16
Updated
2016-12-06
Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges.
Max CVSS
7.8
EPSS Score
0.04%
Published
2017-06-13
Updated
2017-06-28
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system.
Max CVSS
10.0
EPSS Score
1.05%
Published
2020-03-27
Updated
2020-04-01
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges by launching signed Lenovo executables.
Max CVSS
7.8
EPSS Score
0.04%
Published
2017-10-03
Updated
2017-10-17
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type INF and INF_BY_COMPATIBLE_ID command types could allow a user to execute arbitrary code with elevated privileges.
Max CVSS
7.8
EPSS Score
0.04%
Published
2020-03-27
Updated
2020-03-30
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type COMMAND type could allow a user to execute arbitrary code with elevated privileges.
Max CVSS
7.8
EPSS Score
0.04%
Published
2020-03-27
Updated
2020-03-30
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow a user to execute arbitrary code with elevated privileges.
Max CVSS
7.0
EPSS Score
0.04%
Published
2020-03-27
Updated
2020-03-30
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed.
Max CVSS
7.5
EPSS Score
0.08%
Published
2020-03-27
Updated
2020-04-01
357 vulnerabilities found
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!