Lenovo
Page 4 of 5 — Lenovo CVEs from a corpus of 481, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-3462 | Medium | 5.5 | 2021-04-13 | A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the… |
CVE-2021-3417 | Medium | 4.9 | 2021-03-09 | An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator (LXCA), if added as a Resourc… |
CVE-2020-8357 | Medium | 5.5 | 2021-03-09 | A denial of service vulnerability was reported in Lenovo PCManager, prior to version 3.0.200.2042, that could allow configuration files to be written to non-st… |
CVE-2020-8356 | Medium | 4.9 | 2021-03-09 | An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are wr… |
CVE-2020-8355 | Medium | 4.9 | 2021-02-10 | An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA us… |
CVE-2020-8351 | High | 7.8 | 2020-11-30 | A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an authenticated user to execute code with… |
CVE-2020-8354 | Medium | 6.4 | 2020-11-11 | A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook models may allow arbitrary code execution. |
CVE-2020-8353 | Medium | 6.7 | 2020-11-11 | Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabl… |
CVE-2020-8352 | Low | 2.4 | 2020-11-11 | In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes. |
CVE-2020-8350 | High | 8.8 | 2020-10-14 | An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escalation of privilege. |
CVE-2020-8349 | Critical | 9.8 | 2020-10-14 | An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS)’ optional REST AP… |
CVE-2020-8345 | High | 7.3 | 2020-10-14 | A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that cou… |
CVE-2020-8338 | High | 7.8 | 2020-10-14 | A DLL search path vulnerability was reported in Lenovo Diagnostics prior to version 4.35.4 that could allow a user with local access to execute code on the sys… |
CVE-2020-8332 | Medium | 6.4 | 2020-10-14 | A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitr… |
CVE-2020-8348 | Medium | 6.1 | 2020-09-24 | A DOM-based cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow exec… |
CVE-2020-8347 | Medium | 6.1 | 2020-09-24 | A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow exe… |
CVE-2020-8333 | Medium | 6.4 | 2020-09-24 | A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code execu… |
CVE-2020-8346 | Medium | 5.5 | 2020-09-15 | A denial of service vulnerability was reported in the Lenovo Vantage component called Lenovo System Interface Foundation prior to version 1.1.19.5 that could a… |
CVE-2020-8342 | High | 7.3 | 2020-09-15 | A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege. |
CVE-2020-8340 | Medium | 6.3 | 2020-09-15 | A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Management Module 2), prior to version 5.60, e… |
CVE-2020-8341 | Low | 2.4 | 2020-09-01 | In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protecti… |
CVE-2020-8335 | Medium | 6.1 | 2020-09-01 | The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj65w; T495 BIOS vers… |
CVE-2020-8326 | High | 7.3 | 2020-07-24 | An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execu… |
CVE-2020-8317 | High | 7.3 | 2020-07-24 | A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execute code… |
CVE-2019-18619 | High | 7.8 | 2020-07-22 | Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to… |
CVE-2019-18618 | Medium | 6.0 | 2020-07-22 | Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external flash (all versions prior to 2019-11-15) allows… |
CVE-2020-8337 | Medium | 6.7 | 2020-06-09 | An unquoted search path vulnerability was reported in versions prior to 1.0.83.0 of the Synaptics Smart Audio UWP app associated with the DCHU audio drivers on… |
CVE-2020-8336 | Medium | 6.4 | 2020-06-09 | Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmware in flash. |
CVE-2020-8334 | Medium | 6.1 | 2020-06-09 | The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T495s, X395, T495, A485, A285, A475, A275 which may allow for unauthorized access. |
CVE-2020-8323 | Medium | 6.4 | 2020-06-09 | A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStation, and Lenovo Notebook models may allow… |
CVE-2020-8322 | Medium | 6.4 | 2020-06-09 | A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code e… |
CVE-2020-8321 | Medium | 6.4 | 2020-06-09 | A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may allow… |
CVE-2020-8320 | Medium | 6.4 | 2020-06-09 | An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege. |
CVE-2019-6196 | Medium | 6.7 | 2020-06-09 | A symbolic link vulnerability in some Lenovo installation packages, prior to version 1.2.9.3, could allow privileged file operations during file extraction and… |
CVE-2019-6173 | Medium | 6.7 | 2020-06-09 | A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during installation if an atta… |
CVE-2020-8330 | Medium | 5.3 | 2020-05-28 | A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user s… |
CVE-2020-8329 | Medium | 5.3 | 2020-05-28 | A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user s… |
CVE-2020-8327 | High | 7.3 | 2020-04-14 | A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vantage prior to versio… |
CVE-2020-8324 | Medium | 5.0 | 2020-04-14 | A vulnerability was reported in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation prior to version 1.2.184.31 that could allow unsigned DLL… |
CVE-2020-8319 | High | 7.3 | 2020-04-14 | A privilege escalation vulnerability was reported in Lenovo System Interface Foundation prior to version 1.1.19.3 that could allow an authenticated user to exe… |
CVE-2020-8318 | High | 7.3 | 2020-04-14 | A privilege escalation vulnerability was reported in the LenovoSystemUpdatePlugin for Lenovo System Interface Foundation prior to version that could allow an a… |
CVE-2020-8316 | Medium | 4.4 | 2020-04-14 | A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the system with elevated p… |
CVE-2015-8536 | High | 8.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was discovered (fixed and publicly disclosed in 2015) in Le… |
CVE-2015-8535 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disc… |
CVE-2015-8534 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was discovered (fixed and public… |
CVE-2015-7336 | High | 7.5 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Leno… |
CVE-2015-7335 | High | 7.0 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Len… |
CVE-2015-7334 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly… |
CVE-2015-7333 | High | 7.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly… |
CVE-2015-5684 | Critical | 9.8 | 2020-03-27 | MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed… |
CVE-2019-19756 | High | 7.9 | 2020-03-13 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems… |
CVE-2019-6195 | Medium | 4.8 | 2020-02-14 | An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user… |
CVE-2019-6194 | Medium | 5.7 | 2020-02-14 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information… |
CVE-2019-6193 | High | 7.5 | 2020-02-14 | An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to… |
CVE-2019-6190 | Medium | 5.0 | 2020-02-14 | Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStati… |
CVE-2019-19758 | Medium | 6.1 | 2020-02-14 | A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote at… |
CVE-2019-19757 | Medium | 5.4 | 2020-02-14 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in… |
CVE-2019-6192 | Medium | 4.4 | 2019-12-10 | A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a buffer overflow which could cause a den… |
CVE-2019-6183 | High | 7.5 | 2019-12-10 | A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that could cause systems to… |
CVE-2019-6191 | High | 7.8 | 2019-11-20 | A potential vulnerability in the discontinued LenovoPaper software version 1.0.0.22 may allow local privilege escalation. |
CVE-2019-6189 | High | 7.8 | 2019-11-20 | A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an administrative user to load an unsig… |
CVE-2019-6187 | Medium | 6.5 | 2019-11-20 | A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned us… |
CVE-2019-6186 | High | 8.8 | 2019-11-20 | A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an authenticated user to execute code a… |
CVE-2019-6184 | High | 7.8 | 2019-11-20 | A potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software version 2.0.21.1 may allow local privilege escalation. |
CVE-2019-6176 | High | 7.5 | 2019-11-20 | A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service. |
CVE-2019-6188 | Critical | 9.8 | 2019-11-12 | The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which ma… |
CVE-2019-6172 | Medium | 6.4 | 2019-11-12 | A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad mod… |
CVE-2019-6170 | Medium | 6.4 | 2019-11-12 | A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad mod… |
CVE-2019-6175 | High | 7.5 | 2019-09-26 | A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-st… |
CVE-2019-6161 | High | 7.5 | 2019-09-26 | An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC in firmware version… |
CVE-2019-6182 | Medium | 4.9 | 2019-09-03 | A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to st… |
CVE-2019-6181 | Medium | 6.1 | 2019-09-03 | A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow a crafted UR… |
CVE-2019-6180 | Medium | 4.8 | 2019-09-03 | A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrati… |
CVE-2019-6179 | High | 7.5 | 2019-09-03 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator… |
CVE-2019-10724 | Medium | 6.5 | 2019-08-29 | There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher… |
CVE-2019-6177 | Critical | 9.8 | 2019-08-21 | A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locatio… |
CVE-2019-6178 | Medium | 5.3 | 2019-08-19 | An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names through the device… |
CVE-2019-6171 | Medium | 6.8 | 2019-08-19 | A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or physical access the a… |
CVE-2019-6165 | High | 7.8 | 2019-08-19 | A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for… |
CVE-2019-6159 | Medium | 6.1 | 2019-08-19 | A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseboard Management Con… |
CVE-2019-6160 | High | 8.8 | 2019-07-16 | A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API. |
CVE-2019-6169 | High | 7.5 | 2019-06-26 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP. |
CVE-2019-6168 | Critical | 9.8 | 2019-06-26 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. |
CVE-2019-6167 | Critical | 9.8 | 2019-06-26 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. |
CVE-2019-6166 | High | 8.8 | 2019-06-26 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery. |
CVE-2019-6163 | Medium | 5.5 | 2019-06-26 | A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standar… |
CVE-2019-0164 | High | 7.3 | 2019-06-13 | Improper permissions in the installer for Intel(R) Turbo Boost Max Technology 3.0 driver version 1.0.0.1035 and before may allow an authenticated user to poten… |
CVE-2019-0130 | High | 7.4 | 2019-06-13 | Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to potenti… |
CVE-2019-6158 | High | 8.7 | 2019-05-03 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This on… |
CVE-2019-6157 | Medium | 6.5 | 2019-04-22 | In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's priva… |
CVE-2019-6156 | Low | 3.3 | 2019-04-10 | In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protecti… |
CVE-2019-6154 | Medium | 5.3 | 2019-04-10 | A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to ex… |
CVE-2019-6149 | Medium | 6.7 | 2019-03-18 | An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with… |
CVE-2019-0135 | High | 7.8 | 2019-03-14 | Improper permissions in the installer for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an authenticated user to po… |
CVE-2018-16098 | High | 7.8 | 2019-01-24 | In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unautho… |
CVE-2018-9072 | Medium | 6.5 | 2018-11-30 | In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads. |
CVE-2018-16097 | Medium | 6.5 | 2018-11-30 | LXCI for VMware versions prior to 5.5 and LXCI for Microsoft System Center versions prior to 3.5, allow an authenticated user to write to any system file due t… |
CVE-2018-16093 | Medium | 6.5 | 2018-11-30 | In versions prior to 5.5, LXCI for VMware allows an authenticated user to write to any system file due to insufficient sanitization during the upload of a back… |
CVE-2018-9084 | Medium | 6.5 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumve… |
CVE-2018-9083 | High | 8.1 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if t… |