Lenovo
Page 2 of 6 — Lenovo CVEs from a corpus of 523, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-33578 | High | 7.8 | 2024-10-11 | A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges. |
CVE-2024-8281 | High | 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection throu… |
CVE-2024-8280 | High | 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or ca… |
CVE-2024-8279 | High | 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injecti… |
CVE-2024-8278 | High | 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injecti… |
CVE-2024-8059 | Medium | 4.3 | 2024-09-13 | IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. |
CVE-2024-7756 | Medium | 6.8 | 2024-09-13 | A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges by accessing an embe… |
CVE-2024-4550 | Medium | 6.7 | 2024-09-13 | A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attacker with elevated pri… |
CVE-2024-45105 | Medium | 6.7 | 2024-09-13 | An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local at… |
CVE-2024-45104 | Medium | 6.3 | 2024-09-13 | A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially cr… |
CVE-2024-45103 | Medium | 4.3 | 2024-09-13 | A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges. |
CVE-2024-45101 | Medium | 6.8 | 2024-09-13 | A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA… |
CVE-2024-3100 | Medium | 6.7 | 2024-09-13 | A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute a… |
CVE-2024-8105 | Medium | 6.4 | 2024-08-26 | A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK privat… |
CVE-2024-6004 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printer connect… |
CVE-2024-5210 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to prevent printer serv… |
CVE-2024-5209 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to deny printing capabi… |
CVE-2024-4782 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to disrupt the printer'… |
CVE-2024-4781 | Medium | 6.5 | 2024-08-16 | A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to crash printer commun… |
CVE-2024-4763 | High | 7.8 | 2024-08-16 | An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow a lo… |
CVE-2024-2175 | High | 7.8 | 2024-08-16 | An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) that could allow… |
CVE-2023-1577 | High | 7.8 | 2024-07-31 | A path hijacking vulnerability was reported in Lenovo Driver Manager prior to version 3.1.1307.1308 that could allow a local user to execute code with elevated… |
CVE-2019-6198 | High | 7.8 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. |
CVE-2019-6197 | High | 7.8 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. |
CVE-2017-3772 | Medium | 5.5 | 2024-07-31 | A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot. |
CVE-2024-4786 | Low | 2.8 | 2024-07-26 | An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device on. |
CVE-2024-38512 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via… |
CVE-2024-38511 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privi… |
CVE-2024-38510 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privile… |
CVE-2024-38509 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a… |
CVE-2024-38508 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC us… |
CVE-2024-4696 | High | 7.5 | 2024-06-13 | A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system commands to be executed… |
CVE-2024-3286 | High | 7.5 | 2024-05-16 | A buffer overflow vulnerability was identified in some Lenovo printers that could allow an unauthenticated user to trigger a device restart by sending a speci… |
CVE-2024-2659 | High | 7.2 | 2024-04-15 | A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system command… |
CVE-2024-23594 | Medium | 6.4 | 2024-04-15 | A buffer overflow vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from 201… |
CVE-2024-23593 | Medium | 6.7 | 2024-04-15 | A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from 2012 to 2014 that… |
CVE-2023-4857 | High | 7.5 | 2024-04-15 | An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead… |
CVE-2023-4856 | High | 8.8 | 2024-04-15 | A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoi… |
CVE-2023-4855 | High | 7.2 | 2024-04-15 | A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized c… |
CVE-2024-27912 | High | 7.5 | 2024-04-05 | A denial of service vulnerability was reported in some Lenovo Printers that could allow an attacker to cause the device to crash by sending crafted LPD packets. |
CVE-2024-27911 | High | 7.5 | 2024-04-05 | A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator password. |
CVE-2024-27910 | Medium | 5.3 | 2024-04-05 | A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authentication. |
CVE-2024-27909 | Medium | 4.9 | 2024-04-05 | A denial of service vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in a system reboot. |
CVE-2024-27908 | Medium | 4.9 | 2024-04-05 | A buffer overflow vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in denial of service. |
CVE-2024-23592 | Medium | 6.3 | 2024-04-05 | An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with physical access to r… |
CVE-2023-5912 | Medium | 6.7 | 2024-04-05 | A potential memory leakage vulnerability was reported in some Lenovo Notebook products that may allow a local attacker with elevated privileges to write to NV… |
CVE-2023-4605 | Medium | 6.5 | 2024-04-05 | A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information… |
CVE-2023-25494 | Medium | 6.7 | 2024-04-05 | A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacker with elevated pri… |
CVE-2023-25493 | Medium | 6.7 | 2024-04-05 | A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a… |
CVE-2024-23591 | Low | 2.0 | 2024-02-16 | ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privile… |
CVE-2023-6450 | Medium | 5.5 | 2024-01-19 | An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of… |
CVE-2023-6044 | Medium | 6.3 | 2024-01-19 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Servic… |
CVE-2023-6043 | High | 7.8 | 2024-01-19 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code wit… |
CVE-2023-5081 | Low | 3.3 | 2024-01-19 | An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier. |
CVE-2023-5080 | Medium | 6.8 | 2024-01-19 | A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system co… |
CVE-2023-6540 | Medium | 6.5 | 2024-01-03 | A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could res… |
CVE-2023-6338 | High | 7.8 | 2024-01-03 | Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute co… |
CVE-2023-45079 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-45078 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM var… |
CVE-2023-45077 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-45076 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-45075 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-43581 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arb… |
CVE-2023-43580 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute a… |
CVE-2023-43579 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbi… |
CVE-2023-43578 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbit… |
CVE-2023-43577 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitr… |
CVE-2023-43576 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbit… |
CVE-2023-43575 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to exe… |
CVE-2023-43574 | Medium | 4.4 | 2023-11-08 | A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated pri… |
CVE-2023-43573 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated priv… |
CVE-2023-43572 | Medium | 4.4 | 2023-11-08 | A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to d… |
CVE-2023-43571 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to ex… |
CVE-2023-5079 | High | 7.5 | 2023-11-08 | Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information di… |
CVE-2023-5078 | Medium | 6.7 | 2023-11-08 | A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware. |
CVE-2023-5075 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated privileges to exec… |
CVE-2023-4891 | Medium | 5.5 | 2023-11-08 | A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service. |
CVE-2023-4706 | High | 7.3 | 2023-11-08 | A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrec… |
CVE-2023-4632 | High | 7.8 | 2023-11-08 | An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated pri… |
CVE-2023-43570 | Medium | 6.7 | 2023-11-08 | A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute… |
CVE-2023-43569 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitra… |
CVE-2023-43568 | Medium | 4.4 | 2023-11-08 | A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to… |
CVE-2023-43567 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to… |
CVE-2022-4575 | Medium | 6.7 | 2023-10-30 | A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or l… |
CVE-2022-4574 | Medium | 6.7 | 2023-10-30 | An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute… |
CVE-2022-4573 | Medium | 6.7 | 2023-10-30 | An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbit… |
CVE-2022-48189 | Medium | 6.7 | 2023-10-30 | An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute a… |
CVE-2022-3702 | Medium | 6.1 | 2023-10-27 | A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local attacker to delete c… |
CVE-2022-3701 | High | 7.8 | 2023-10-27 | A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a local attacker to… |
CVE-2022-3700 | Medium | 6.1 | 2023-10-27 | A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a loca… |
CVE-2022-3611 | High | 7.6 | 2023-10-27 | An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive… |
CVE-2022-3429 | Medium | 6.5 | 2023-10-27 | A denial-of-service vulnerability was found in the firmware used in Lenovo printers, where users send illegal or malformed strings to an open port, triggering… |
CVE-2022-34887 | Medium | 4.3 | 2023-10-27 | Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the adm… |
CVE-2022-34886 | High | 8.8 | 2023-10-27 | A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to… |
CVE-2023-4608 | Medium | 4.1 | 2023-10-25 | An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v… |
CVE-2023-4607 | High | 7.5 | 2023-10-25 | An authenticated XCC user can change permissions for any user through a crafted API command. |
CVE-2023-4606 | High | 8.1 | 2023-10-25 | An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3… |
CVE-2023-3112 | High | 7.8 | 2023-10-25 | A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with el… |
CVE-2022-3699 | High | 7.8 | 2023-10-25 | A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 t… |
CVE-2022-3698 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |