CVSS: 7.2EPSS: 0%CPEs: 101EXPL: 0CVE-2018-9062 – BIOS Modules Unprotected by Intel Boot Guard Vulnerable to Physical Attack
https://notcve.org/view.php?id=CVE-2018-9062
In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code. En algunos ThinkPads de Lenovo, una región de BIOS no se incluye correctamente en las comprobaciones, lo que permite la inyección de código arbitrario. • http://www.securityfocus.com/bid/105387 https://support.lenovo.com/us/en/solutions/LEN-20527 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.8EPSS: 0%CPEs: 47EXPL: 0CVE-2017-3767
https://notcve.org/view.php?id=CVE-2017-3767
A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad products. An attacker with local privileges could execute code with administrative privileges. Se ha identificado una vulnerabilidad de escalado de privilegios en las versiones anteriores a la 6.0.1.8224 del controlador de audio Realtek en productos Lenovo ThinkPad. Un atacante con privilegios locales podría ejecutar código con privilegios administrativos. • https://support.lenovo.com/us/en/product_security/LEN-15759 •
CVSS: 7.8EPSS: 0%CPEs: 151EXPL: 0CVE-2017-3756
https://notcve.org/view.php?id=CVE-2017-3756
A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. An attacker with local privileges could execute code with administrative privileges via an unquoted service path. Se identificó una vulnerabilidad de escalado de privilegios en Lenovo Active Protection System para versiones de sistemas ThinkPad anteriores a la 1.82.0.17. Un atacante con privilegios locales podría ejecutar código con privilegios de administrador a través de una ruta de servicio sin entrecomillar. • http://www.securityfocus.com/bid/100305 https://support.lenovo.com/us/en/product_security/LEN-15765 •
CVSS: 7.2EPSS: 0%CPEs: 222EXPL: 0CVE-2017-3753
https://notcve.org/view.php?id=CVE-2017-3753
A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V. Se ha identificado una vulnerabilidad en algunos productos Lenovo que emplean código UEFI (BIOS) desarrollado por American Megatrends, Inc. (AMI). • https://support.lenovo.com/us/en/product_security/LEN-14695 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 3.3EPSS: 0%CPEs: 3EXPL: 0CVE-2017-3741
https://notcve.org/view.php?id=CVE-2017-3741
In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly. This issue only affects ThinkPad X1 Carbon 5th generation. En el controlador de Lenovo Power Management anterior a versión 1.67.12.24, un usuario local puede modificar el firmware del trackpoint y evitar que el trackpoint funcione correctamente. Este problema solo afecta a la 5a generación de ThinkPad X1 Carbon. • https://support.lenovo.com/us/en/product_security/LEN-14440 •