CVSS: 6.4EPSS: 0%CPEs: 786EXPL: 0CVE-2019-6172
https://notcve.org/view.php?id=CVE-2019-6172
12 Nov 2019 — A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution. Una posible vulnerabilidad en la función de retrollamada SMI utilizada en el controlador USB heredado que utiliza el parámetro de paso sin suficiente comprobación en algunos modelos de ThinkPad de Lenovo puede permitir la ejecución de códigos arbitrarios • https://support.lenovo.com/us/en/product_security/LEN-27714 •
CVSS: 3.3EPSS: 0%CPEs: 356EXPL: 0CVE-2019-6156
https://notcve.org/view.php?id=CVE-2019-6156
10 Apr 2019 — In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected. En los sistemas Lenovo, SMM BIOS Write Protection se utiliza para evitar la escritura en... • https://support.lenovo.com/solutions/LEN-26332 • CWE-667: Improper Locking •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2017-3771
https://notcve.org/view.php?id=CVE-2017-3771
26 Oct 2017 — System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without completing BIOS/UEFI initialization process. No se ha asegurado adecuadamente el proceso de arranque del sistema en Lenovo E95 y ThinkCentre M710s/M710t debido a que los sistemas salían de fábrica sin haber completado el proceso de inicialización BIOS/UEFI. • https://support.lenovo.com/us/en/product_security/LEN-17417 •
CVSS: 7.2EPSS: 0%CPEs: 222EXPL: 0CVE-2017-3753
https://notcve.org/view.php?id=CVE-2017-3753
10 Aug 2017 — A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V. Se ha identificado una vulnerabilidad en algunos productos Lenovo que emplean código UEFI (BIOS) desarrollado por American Megatrends... • https://support.lenovo.com/us/en/product_security/LEN-14695 • CWE-94: Improper Control of Generation of Code ('Code Injection') •