Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-6133 State: PUBLISHED Published: 2019-01-11T14:00:00 Last Updated: 2024-08-04T20:16:23.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/polkit/polkit/commit/c898fdf4b1aafaa04f8ada9d73d77c8bb76e2f81 - https://usn.ubuntu.com/3903-2/ - https://access.redhat.com/errata/RHSA-2019:0230 - https://git.kerne
d73d77c8bb76e2f81 - https://usn.ubuntu.com/3903-2/ - https://access.redhat.com/errata/RHSA-2019:0230 - https://git.kernel.org/linus/7b55851367136b1efd84d98fea81ba57a98304cf - https://lists.debian.org/debian-lts-announce/2019/01/msg00021.html - https://usn.ubuntu.com/3910-1/ - https://usn.ubuntu.com/3901-2/ - https://gitlab.freedesktop.org/polkit/polkit/merge_requests/19 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1692 - https://usn.ubuntu.com/3910-2/ - https://access.redhat.com/errata/RHSA-2019:0420 - https://usn.ubuntu.com/3908-2/ - https://usn.ubuntu.com/3901-1/ - https://usn.ubuntu.com/3903-1/ - http://www.securityfocus.com/bid/106537 - https://usn.ubuntu.com/3908-1/ - htt
901-1/ - https://usn.ubuntu.com/3903-1/ - http://www.securityfocus.com/bid/106537 - https://usn.ubuntu.com/3908-1/ - https://support.f5.com/csp/article/K22715344 - https://usn.ubuntu.com/3934-1/ - https://access.redhat.com/errata/RHSA-2019:0832 - https://lists.debian.org/debian-lts-announce/2019/05/msg00041.html - https://lists.debian.org/debian-lts-announce/2019/05/msg00042.html - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00049.html - https://usn.ubuntu.com/3934-2/ - https://access.redhat.com/errata/RHSA-2019:2699 - https://access.redhat.com/errata/RHSA-2019:2978
CVE ID: CVE-2019-6135 State: PUBLISHED Published: 2019-01-11T17:00:00 Last Updated: 2024-08-04T20:16:24.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libIEC61850 v1.3.1. Memory_malloc in hal/memory/lib_memory.c has a memory leak when called from Asn1PrimitiveValue_create in mms/asn1/asn1_ber_primitive_value.c, as demonstrated by goose_publisher_example.c and iec61850_9_2_LE_example.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mz-automation/libiec61850/issues/103 - https://github.com/mz-automation/libiec61850/issues/104
CVE ID: CVE-2019-6136 State: PUBLISHED Published: 2019-01-11T17:00:00 Last Updated: 2024-08-04T20:16:23.668Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libIEC61850 v1.3.1. Ethernet_setProtocolFilter in hal/ethernet/linux/ethernet_linux.c has a SEGV, as demonstrated by sv_subscriber_example.c and sv_subscriber.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mz-automation/libiec61850/issues/105
CVE ID: CVE-2019-6137 State: PUBLISHED Published: 2019-01-11T17:00:00 Last Updated: 2024-08-04T20:16:24.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in lib60870 2.1.1. LinkLayer_setAddress in link_layer/link_layer.c has a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mz-automation/lib60870/issues/39
CVE ID: CVE-2019-6138 State: PUBLISHED Published: 2019-01-11T17:00:00 Last Updated: 2024-08-04T20:16:24.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue has been found in libIEC61850 v1.3.1. Memory_malloc and Memory_calloc in hal/memory/lib_memory.c have memory leaks when called from mms/iso_mms/common/mms_value.c, server/mms_mapping/mms_mapping.c, and server/mms_mapping/mms_sv.c (via common/string_utilities.c), as demonstrated by iec61850_9_2_LE_example.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mz-automation/libiec61850/issues/103
CVE ID: CVE-2019-6139 State: PUBLISHED Published: 2019-02-07T23:00:00Z Last Updated: 2024-09-17T02:46:31.626Z Vendors: Forcepoint . Products: Forcepoint User ID (FUID) server Problem Types: Remote Code Execution Description: Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitation of this vulnerability may lead to remote code execution. To fix this vulnerability, upgrade to FUID version 1.3 or higher. To prevent the vulnerability on FUID versions 1.2 and below, apply local firewall rules on the FUID server to disable all external access to port TCP/5001. FUID requires this port only for local connections t
on the FUID server to disable all external access to port TCP/5001. FUID requires this port only for local connections through the loopback interface. Additional Analyst Notes: - CVE Program Container: References: - https://help.forcepoint.com/security/CVE/CVE-2019-6139.html
CVE ID: CVE-2019-6140 State: PUBLISHED Published: 2019-04-09T20:51:32 Last Updated: 2024-08-04T20:16:23.961Z Vendors: Forcepoint Products: Forcepoint Email Security Problem Types: CWE-284 Description: A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration process is not completed. Additional Analyst Notes: - CVE Program Container: References: - https://help.forcepoint.com/security/CVE/CVE-2019-6140.html
CVE ID: CVE-2019-6141 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2019-6142 State: PUBLISHED Published: 2019-11-05T20:49:15 Last Updated: 2024-08-04T20:16:24.524Z Vendors: Forcepoint Products: Forcepoint Email Security Problem Types: CWE-79 Description: It has been reported that XSS is possible in Forcepoint Email Security, versions 8.5 and 8.5.3. It is strongly recommended that you apply the relevant hotfix in order to remediate this issue. Additional Analyst Notes: - CVE Program Container: References: - https://help.forcepoint.com/security/CVE/CVE-2019-6142.html
CVE ID: CVE-2019-6143 State: PUBLISHED Published: 2019-08-20T20:24:21 Last Updated: 2024-08-04T20:16:24.383Z Vendors: Forcepoint Products: Forcepoint Next Generation Firewall Problem Types: Authentication Bypass Description: Forcepoint Next Generation Firewall (Forcepoint NGFW) 6.4.x before 6.4.7, 6.5.x before 6.5.4, and 6.6.x before 6.6.2 has a serious authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services protected by the NGFW Engine. The vulnerability affects the following NGFW features when the LDAP authentication method is used as the backend authentication: IPsec VPN, SSL VPN or Browser-based user authentication. Th
authentication method is used as the backend authentication: IPsec VPN, SSL VPN or Browser-based user authentication. The vulnerability does not apply when any other backend authentication is used. The RADIUS authentication method is not vulnerable, for example. Additional Analyst Notes: - CVE Program Container: References: - https://help.forcepoint.com/security/CVE/CVE-2019-6143.html
CVE ID: CVE-2019-6144 State: PUBLISHED Published: 2019-10-23T18:57:51 Last Updated: 2024-08-04T20:16:24.328Z Vendors: n/a Products: Forcepoint One Endpoint Problem Types: CWE-284 Description: This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint (versions 19.04 through 19.08) and bypass DLP and Web protection. Additional Analyst Notes: - CVE Program Container: References: - https://help.forcepoint.com/security/CVE/CVE-2019-6144.html
CVE ID: CVE-2019-6145 State: PUBLISHED Published: 2019-09-20T19:56:34 Last Updated: 2024-08-04T20:16:24.728Z Vendors: Forcepoint Products: Forcepoint VPN Client for Windows Problem Types: Unquoted search path vulnerability Description: Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs for finding this vulnerability and for reporting it to us. Additional Analyst Notes: - CVE Program Container: References: - https://safebreach.com/Post/Forcepoint-V
ting it to us. Additional Analyst Notes: - CVE Program Container: References: - https://safebreach.com/Post/Forcepoint-VPN-Client-for-Windows-Unquoted-Search-Path-and-Potential-Abuses-CVE-2019-6145 - https://help.forcepoint.com/security/CVE/CVE-2019-6145.html
CVE ID: CVE-2019-6146 State: PUBLISHED Published: 2020-01-22T16:10:21 Last Updated: 2024-08-04T20:16:23.669Z Vendors: n/a Products: Forcepoint Web Security Problem Types: CWE-79 Description: It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host header injection. CVSSv3.0: 5.3 (Medium) (/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/156274/Forcepoint-WebSecurity-8.5-Cross-Site-Scripting.html - https://help.forcepoint.com/security/CVE/CVE-2019-6146.html
CVE ID: CVE-2019-6147 State: PUBLISHED Published: 2019-12-23T19:17:18 Last Updated: 2024-08-04T20:16:24.587Z Vendors: Forcepoint Products: NGFW Security Management Center Problem Types: Rare internal database corruption can lead to incorrect IPSec configuration Description: Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific circumstances can corrupt the internal configuration database. When the database is corrupted, the SMC might produce an incorrect IPsec configuration for the Forcepoint Next Generation Firewall (NGFW), possibly resulting in settings that are weaker than expected. All SMC versions lower than 6.5.12 or 6.7
Firewall (NGFW), possibly resulting in settings that are weaker than expected. All SMC versions lower than 6.5.12 or 6.7.1 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://help.forcepoint.com/security/CVE/CVE-2019-6147.html
CVE ID: CVE-2019-6148 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2019-6149 State: PUBLISHED Published: 2019-03-15T22:00:00Z Last Updated: 2024-09-16T19:47:26.228Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: unspecified Products: unspecified Description: An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-25674 - http://www.securityfocus.com/bid/107438
CVE ID: CVE-2019-6150 State: REJECTED Published: 2019-04-17T14:09:52 Last Updated: 2019-04-17T14:09:52 Description: No description available.
CVE ID: CVE-2019-6151 State: REJECTED Published: 2019-04-17T14:10:10 Last Updated: 2019-04-17T14:10:10 Description: No description available.
CVE ID: CVE-2019-6152 State: REJECTED Published: 2019-04-17T14:10:22 Last Updated: 2019-04-17T14:10:22 Description: No description available.
CVE ID: CVE-2019-6153 State: REJECTED Published: 2019-04-17T14:10:38 Last Updated: 2019-04-17T14:10:38 Description: No description available.
CVE ID: CVE-2019-6154 State: PUBLISHED Published: 2019-04-10T17:04:19.857324Z Last Updated: 2024-09-17T02:06:09.759Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Lenovo Products: Lenovo Bootable Generator Problem Types: Code execution Description: A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-25401
CVE ID: CVE-2019-6155 State: PUBLISHED Published: 2019-04-22T15:21:29.643053Z Last Updated: 2024-09-16T18:24:36.117Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: System x BIOS, BladeCenter BIOS Problem Types: Denial of service Description: A potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy IBM System x and IBM BladeCenter systems that could lead to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-25165
CVE ID: CVE-2019-6156 State: PUBLISHED Published: 2019-04-10T17:04:19.908080Z Last Updated: 2024-09-16T22:02:37.776Z Vendors: Lenovo Products: BIOS Problem Types: None Description: In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/sol
keeps systems protected. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-26332
CVE ID: CVE-2019-6157 State: PUBLISHED Published: 2019-04-22T15:21:29.692559Z Last Updated: 2024-09-17T00:06:19.158Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Lenovo Products: System x Problem Types: Information disclosure Description: In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-25667
CVE ID: CVE-2019-6158 State: PUBLISHED Published: 2019-05-03T19:27:27.963262Z Last Updated: 2024-09-16T16:53:25.613Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Lenovo Products: Lenovo XClarity Administrator Problem Types: Information disclosure Description: An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-26141 - http://www.securityfocu
t Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-26141 - http://www.securityfocus.com/bid/108165
CVE ID: CVE-2019-6159 State: PUBLISHED Published: 2019-08-19T14:56:44.914676Z Last Updated: 2024-09-16T20:36:49.496Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: IBM Products: legacy System x IMM (IMM v1) firmware Problem Types: code execution Description: A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Controller (BMC). This vulnerability could allow an unauthenticated user to cause JavaScript code to be stored in the IMM log which may then be executed in the user's web browser when IMM log records containing the JavaScript code are viewed. The J
ich may then be executed in the user's web browser when IMM log records containing the JavaScript code are viewed. The JavaScript code is not executed on IMM itself. The later IMM2 (IMM v2) is not affected. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-24785
CVE ID: CVE-2019-6160 State: PUBLISHED Published: 2019-07-16T18:53:10.650443Z Last Updated: 2024-09-16T18:08:53.112Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Iomega and LenovoEMC Products: NAS products Problem Types: Information disclosure Description: A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-25557
CVE ID: CVE-2019-6161 State: PUBLISHED Published: 2019-09-26T15:22:15.136039Z Last Updated: 2024-09-17T01:37:00.542Z Vendors: Lenovo Products: ThinkAgile CP-SB Problem Types: unauthorized access Description: An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC in firmware versions prior to 1908.M. This vulnerability allows session IDs to be reused, which could provide unauthorized access to the BMC under certain circumstances. This vulnerability does not affect ThinkSystem XCC, System x IMM2, or other BMCs. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solution
MM2, or other BMCs. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-26957
CVE ID: CVE-2019-6162 State: REJECTED Published: N/A Last Updated: 2024-07-29T20:39:11.671Z Description: No description available.
CVE ID: CVE-2019-6163 State: PUBLISHED Published: 2019-06-26T14:12:34.696699Z Last Updated: 2024-09-16T23:41:01.176Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: System Update Problem Types: privilege escalation Description: A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-27348
CVE ID: CVE-2019-6164 State: REJECTED Published: N/A Last Updated: 2024-07-29T20:39:41.267Z Description: No description available.
CVE ID: CVE-2019-6165 State: PUBLISHED Published: 2019-08-19T14:56:44.995622Z Last Updated: 2024-09-16T20:52:04.234Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: PaperDisplay Hotkey Service Problem Types: Privilege escalation Description: A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 10 Build 1703 provides similar features. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-27569
CVE ID: CVE-2019-6166 State: PUBLISHED Published: 2019-06-26T14:12:34.747569Z Last Updated: 2024-09-16T17:14:55.601Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Lenovo Products: Service Bridge Problem Types: cross-site request forgery Description: A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-27725
CVE ID: CVE-2019-6167 State: PUBLISHED Published: 2019-06-26T14:12:34.783642Z Last Updated: 2024-09-16T17:02:52.749Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Service Bridge Problem Types: remote code execution Description: A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-27725
CVE ID: CVE-2019-6168 State: PUBLISHED Published: 2019-06-26T14:12:34.822409Z Last Updated: 2024-09-16T23:41:33.425Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Service Bridge Problem Types: remote code execution Description: A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-27725
CVE ID: CVE-2019-6169 State: PUBLISHED Published: 2019-06-26T14:12:34.865362Z Last Updated: 2024-09-16T20:32:51.243Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Lenovo Products: Service Bridge Problem Types: unencrypted downloads over FTP Description: A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-27725
CVE ID: CVE-2019-6170 State: PUBLISHED Published: 2019-11-12T20:40:53 Last Updated: 2024-08-04T20:16:24.582Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad Problem Types: Arbitrary code execution Description: A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-27714
CVE ID: CVE-2019-6171 State: PUBLISHED Published: 2019-08-19T14:56:45.041686Z Last Updated: 2024-09-16T20:03:17.346Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: BIOS Problem Types: Privilege escalation Description: A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or physical access the ability to update the Embedded Controller with unsigned firmware. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-27764
CVE ID: CVE-2019-6172 State: PUBLISHED Published: 2019-11-12T20:40:53 Last Updated: 2024-08-04T20:16:23.751Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad Problem Types: Arbitrary code execution Description: A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-27714
CVE ID: CVE-2019-6173 State: PUBLISHED Published: 2020-06-09T19:50:34.062224Z Last Updated: 2024-09-16T17:54:54.225Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Installation Packages Problem Types: CWE-426 Description: A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during installation if an attacker already has administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/len-27431
CVE ID: CVE-2019-6174 State: REJECTED Published: N/A Last Updated: 2024-07-29T20:39:56.732Z Description: No description available.
CVE ID: CVE-2019-6175 State: PUBLISHED Published: 2019-09-26T15:22:15 Last Updated: 2024-08-04T20:16:23.600Z Vendors: Lenovo Products: System Update Problem Types: Denial of service Description: A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-standard locations. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/solutions/LEN-28093