Lenovo
Page 3 of 5 — Lenovo CVEs from a corpus of 481, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0353 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |
CVE-2022-48183 | Medium | 6.1 | 2023-10-09 | A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstan… |
CVE-2022-48182 | Medium | 6.1 | 2023-10-09 | A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstan… |
CVE-2022-3728 | Medium | 6.1 | 2023-10-09 | A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstan… |
CVE-2022-3431 | Medium | 6.7 | 2023-10-09 | A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow… |
CVE-2022-3746 | Medium | 6.7 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to ca… |
CVE-2022-3745 | Medium | 4.4 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to vi… |
CVE-2022-3744 | Medium | 6.7 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to un… |
CVE-2022-3743 | Medium | 4.4 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under… |
CVE-2022-3742 | Medium | 6.7 | 2023-08-23 | A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to ex… |
CVE-2023-4030 | High | 8.4 | 2023-08-17 | A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings… |
CVE-2023-4029 | Medium | 6.7 | 2023-08-17 | A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and eleva… |
CVE-2023-4028 | Medium | 6.7 | 2023-08-17 | A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access an… |
CVE-2023-3078 | High | 7.8 | 2023-08-17 | An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute co… |
CVE-2023-34419 | Medium | 6.7 | 2023-08-17 | A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated pr… |
CVE-2023-3113 | High | 8.2 | 2023-06-26 | An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only acce… |
CVE-2023-34422 | Medium | 6.5 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due… |
CVE-2023-34421 | Medium | 6.5 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficien… |
CVE-2023-34420 | High | 7.2 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. |
CVE-2023-34418 | High | 8.1 | 2023-06-26 | A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a spec… |
CVE-2023-2993 | Medium | 5.4 | 2023-06-26 | A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of comm… |
CVE-2023-2992 | High | 7.5 | 2023-06-26 | An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions… |
CVE-2023-2290 | Medium | 6.4 | 2023-06-26 | A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to execute arbitrary co… |
CVE-2022-48188 | Medium | 6.7 | 2023-06-05 | A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to el… |
CVE-2022-48181 | Medium | 6.7 | 2023-06-05 | An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their pri… |
CVE-2022-4569 | High | 7.8 | 2023-06-05 | A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execu… |
CVE-2023-25492 | Medium | 6.3 | 2023-05-01 | A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string inject… |
CVE-2023-0683 | High | 8.3 | 2023-05-01 | A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call. |
CVE-2022-4568 | High | 7.0 | 2023-05-01 | A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges. |
CVE-2022-48186 | Medium | 6.2 | 2023-05-01 | A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure. |
CVE-2023-0896 | High | 8.8 | 2023-05-01 | A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attacker with local netwo… |
CVE-2023-29056 | Medium | 5.3 | 2023-04-28 | A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to u… |
CVE-2023-25496 | High | 7.8 | 2023-04-28 | A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execute code with elevate… |
CVE-2023-25495 | Medium | 4.9 | 2023-04-28 | A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an extern… |
CVE-2023-29058 | Medium | 6.4 | 2023-04-28 | A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CL… |
CVE-2023-29057 | High | 7.3 | 2023-04-28 | A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalat… |
CVE-2022-40137 | Medium | 6.7 | 2023-01-30 | A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code. |
CVE-2022-40136 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and… |
CVE-2022-40135 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges… |
CVE-2022-40134 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privilege… |
CVE-2022-34888 | Low | 2.7 | 2023-01-30 | The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible t… |
CVE-2022-34884 | High | 7.2 | 2023-01-30 | A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of ser… |
CVE-2022-3432 | Medium | 6.7 | 2023-01-26 | A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker wit… |
CVE-2022-1892 | Medium | 6.7 | 2023-01-26 | A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code. |
CVE-2022-1891 | Medium | 6.7 | 2023-01-26 | A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code. |
CVE-2022-1890 | Medium | 6.7 | 2023-01-26 | A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code. |
CVE-2022-4816 | Medium | 6.2 | 2023-01-23 | A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application. |
CVE-2022-3430 | Medium | 6.7 | 2023-01-23 | A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot… |
CVE-2022-1109 | Medium | 5.5 | 2023-01-20 | An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service. |
CVE-2022-4435 | Medium | 6.7 | 2023-01-05 | A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoRemoteConfigUpdateDxe driver that could allow a local attacker with elevated privi… |
CVE-2022-4434 | Medium | 6.7 | 2023-01-05 | A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS driver that could allow a local attacker with elevated privileges to cause information d… |
CVE-2022-4433 | Medium | 6.7 | 2023-01-05 | A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elevated privileges t… |
CVE-2022-4432 | Medium | 6.7 | 2023-01-05 | A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges t… |
CVE-2019-19705 | High | 7.8 | 2022-12-26 | Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG before 6.0.8907.1 (a… |
CVE-2021-42205 | Medium | 4.7 | 2022-11-07 | ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by send… |
CVE-2022-1513 | High | 7.3 | 2022-08-23 | A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website. |
CVE-2022-1110 | Medium | 5.5 | 2022-05-18 | A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of service. |
CVE-2021-42852 | High | 8.0 | 2022-05-18 | A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system… |
CVE-2021-42851 | Medium | 6.3 | 2022-05-18 | A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account. |
CVE-2021-42850 | High | 8.8 | 2022-05-18 | A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unautho… |
CVE-2021-42849 | Medium | 6.8 | 2022-05-18 | A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attack… |
CVE-2021-42848 | Medium | 4.3 | 2022-05-18 | An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device… |
CVE-2021-3969 | High | 7.8 | 2022-05-18 | A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1… |
CVE-2021-3956 | Medium | 4.3 | 2022-05-18 | A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devic… |
CVE-2021-3922 | High | 7.8 | 2022-05-18 | A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 that could a… |
CVE-2022-1108 | Medium | 6.7 | 2022-04-22 | A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an at… |
CVE-2022-1107 | Medium | 6.7 | 2022-04-22 | During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad… |
CVE-2022-0636 | Medium | 5.0 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash. |
CVE-2022-0354 | High | 7.3 | 2022-04-22 | A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated pri… |
CVE-2022-0192 | High | 7.3 | 2022-04-22 | A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation. |
CVE-2021-4212 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local acce… |
CVE-2021-4211 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow… |
CVE-2021-4210 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker… |
CVE-2021-3972 | Medium | 6.7 | 2022-04-22 | A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may… |
CVE-2021-3971 | Medium | 6.7 | 2022-04-22 | A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BI… |
CVE-2021-3970 | Medium | 6.7 | 2022-04-22 | A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with local acc… |
CVE-2021-3897 | Critical | 9.8 | 2022-04-22 | An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SM… |
CVE-2021-3849 | Critical | 9.8 | 2022-04-22 | An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM)… |
CVE-2021-3722 | Medium | 5.0 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be written to non-stand… |
CVE-2021-3721 | Medium | 5.5 | 2022-04-22 | A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local access to trigger a bl… |
CVE-2021-3843 | Medium | 6.7 | 2021-11-12 | A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execu… |
CVE-2021-3840 | High | 8.8 | 2021-11-12 | A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during… |
CVE-2021-3786 | Medium | 4.4 | 2021-11-12 | A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data o… |
CVE-2021-3720 | Medium | 5.5 | 2021-11-12 | An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) that could a… |
CVE-2021-3719 | Medium | 6.7 | 2021-11-12 | A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and Thi… |
CVE-2021-3718 | Medium | 4.3 | 2021-11-12 | A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BI… |
CVE-2021-3599 | Medium | 6.7 | 2021-11-12 | A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated… |
CVE-2021-3519 | Medium | 6.4 | 2021-11-12 | A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List"… |
CVE-2021-3633 | High | 7.3 | 2021-08-17 | A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation. |
CVE-2021-3617 | High | 7.2 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. Th… |
CVE-2021-3616 | Critical | 9.4 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content an… |
CVE-2021-3615 | Medium | 6.6 | 2021-08-17 | A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vul… |
CVE-2021-3614 | Medium | 6.4 | 2021-07-16 | A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions d… |
CVE-2021-3550 | High | 7.8 | 2021-07-16 | A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.500.5102, that could allow privilege escalation. |
CVE-2021-3453 | Medium | 6.8 | 2021-07-16 | Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access… |
CVE-2021-3452 | Medium | 6.7 | 2021-07-16 | A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges… |
CVE-2021-3464 | High | 7.8 | 2021-04-27 | A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow privilege escalation. |
CVE-2021-3451 | Medium | 5.5 | 2021-04-27 | A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow configuration files to be written to non-st… |
CVE-2021-3473 | Medium | 4.5 | 2021-04-13 | An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an inter… |
CVE-2021-3463 | Medium | 4.2 | 2021-04-13 | A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause systems to experience… |