# cve.now: Lenovo

The newest entries naming Lenovo as an affected vendor (up to 200), of 401 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-92777](https://cve.now/CVE-2026-92777.md): A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an unlocked tablet to bypass d (CVSS 5.4)
- [CVE-2026-92629](https://cve.now/CVE-2026-92629.md): A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, th (CVSS 7.0)
- [CVE-2026-89062](https://cve.now/CVE-2026-89062.md): A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a local authenticated use (CVSS 6.8)
- [CVE-2026-89057](https://cve.now/CVE-2026-89057.md): A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain una (CVSS 7.0)
- [CVE-2026-75941](https://cve.now/CVE-2026-75941.md): A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allo (CVSS 8.6)
- [CVE-2026-16755](https://cve.now/CVE-2026-16755.md): A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an unauth (CVSS 6.0)
- [CVE-2026-16754](https://cve.now/CVE-2026-16754.md): A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese ma (CVSS 5.9)
- [CVE-2026-11813](https://cve.now/CVE-2026-11813.md): A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated us (CVSS 8.5)
- [CVE-2026-18994](https://cve.now/CVE-2026-18994.md): A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the (CVSS 8.4)
- [CVE-2026-19136](https://cve.now/CVE-2026-19136.md): A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese marke (CVSS 8.4)
- [CVE-2026-63427](https://cve.now/CVE-2026-63427.md): An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrar (CVSS 8.5)
- [CVE-2026-75940](https://cve.now/CVE-2026-75940.md): A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attack (CVSS 9.3)
- [CVE-2026-14256](https://cve.now/CVE-2026-14256.md): ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a l (CVSS 5.7)
- [CVE-2026-15994](https://cve.now/CVE-2026-15994.md): During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vant (CVSS 7.3)
- [CVE-2026-63423](https://cve.now/CVE-2026-63423.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise fo (CVSS 8.5)
- [CVE-2026-63424](https://cve.now/CVE-2026-63424.md): During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authentic (CVSS 7.0)
- [CVE-2026-63425](https://cve.now/CVE-2026-63425.md): During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allo (CVSS 8.5)
- [CVE-2026-63426](https://cve.now/CVE-2026-63426.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated lo (CVSS 6.9)
- [CVE-2026-12036](https://cve.now/CVE-2026-12036.md): An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could al (CVSS 6.9)
- [CVE-2026-6387](https://cve.now/CVE-2026-6387.md): A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute (CVSS 7.3)
- [CVE-2026-16793](https://cve.now/CVE-2026-16793.md): Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator (CVSS 8.8)
- [CVE-2026-16792](https://cve.now/CVE-2026-16792.md): Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator (CVSS 6.1)
- [CVE-2026-16791](https://cve.now/CVE-2026-16791.md): Predictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLI (CVSS 3.9)
- [CVE-2026-10590](https://cve.now/CVE-2026-10590.md): A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System (CVSS 6.7)
- [CVE-2026-10589](https://cve.now/CVE-2026-10589.md): A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode. (CVSS 6.8)
- [CVE-2026-10588](https://cve.now/CVE-2026-10588.md): A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory. (CVSS 6.7)
- [CVE-2026-10587](https://cve.now/CVE-2026-10587.md): A potential out-of-bounds write vulnerability could allow a local privileged attacker to modify power management settings in System Manageme (CVSS 6.8)
- [CVE-2026-14371](https://cve.now/CVE-2026-14371.md): The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershel (CVSS 8.8)
- [CVE-2026-13104](https://cve.now/CVE-2026-13104.md): A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenti (CVSS 7.0)
- [CVE-2026-13103](https://cve.now/CVE-2026-13103.md): A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a (CVSS 7.0)
- [CVE-2026-9046](https://cve.now/CVE-2026-9046.md): A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclus (CVSS 7.3)
- [CVE-2026-6511](https://cve.now/CVE-2026-6511.md): During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows (CVSS 6.8)
- [CVE-2025-10238](https://cve.now/CVE-2025-10238.md): During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products c (CVSS 8.4)
- [CVE-2025-10237](https://cve.now/CVE-2025-10237.md): During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could al (CVSS 8.4)
- [CVE-2026-6090](https://cve.now/CVE-2026-6090.md): A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute ar (CVSS 7.3)
- [CVE-2026-8637](https://cve.now/CVE-2026-8637.md): A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authent (CVSS 8.5)
- [CVE-2026-9045](https://cve.now/CVE-2026-9045.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise fo (CVSS 8.5)
- [CVE-2026-7516](https://cve.now/CVE-2026-7516.md): A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow (CVSS 5.1)
- [CVE-2026-6282](https://cve.now/CVE-2026-6282.md): A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote (CVSS 8.6)
- [CVE-2026-6281](https://cve.now/CVE-2026-6281.md): A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the loc (CVSS 8.7)
- [CVE-2026-4145](https://cve.now/CVE-2026-4145.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticat (CVSS 8.5)
- [CVE-2026-4135](https://cve.now/CVE-2026-4135.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allo (CVSS 5.2)
- [CVE-2026-4134](https://cve.now/CVE-2026-4134.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allo (CVSS 7.0)
- [CVE-2026-1636](https://cve.now/CVE-2026-1636.md): A potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authentica (CVSS 5.4)
- [CVE-2026-0827](https://cve.now/CVE-2026-0827.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo Diagnostics and the HardwareScanAddin used in Len (CVSS 6.9)
- [CVE-2026-2640](https://cve.now/CVE-2026-2640.md): During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager that could allow a local authenticated (CVSS 6.8)
- [CVE-2026-1717](https://cve.now/CVE-2026-1717.md): An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could all (CVSS 6.8)
- [CVE-2026-1716](https://cve.now/CVE-2026-1716.md): An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a (CVSS 6.9)
- [CVE-2026-1715](https://cve.now/CVE-2026-1715.md): An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a (CVSS 6.9)
- [CVE-2026-1653](https://cve.now/CVE-2026-1653.md): A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authen (CVSS 6.8)
- [CVE-2026-1652](https://cve.now/CVE-2026-1652.md): A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect that could allow a local authe (CVSS 6.9)
- [CVE-2026-0940](https://cve.now/CVE-2026-0940.md): A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to mod (CVSS 8.4)
- [CVE-2026-2368](https://cve.now/CVE-2026-2368.md): An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptin (CVSS 7.5)
- [CVE-2026-1068](https://cve.now/CVE-2026-1068.md): An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of interceptin (CVSS 6.0)
- [CVE-2026-0520](https://cve.now/CVE-2026-0520.md): A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authentic (CVSS 2.4)
- [CVE-2025-14058](https://cve.now/CVE-2025-14058.md): A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical acc (CVSS 2.4)
- [CVE-2026-0421](https://cve.now/CVE-2026-0421.md): A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads which could result in (CVSS 7.0)
- [CVE-2025-13455](https://cve.now/CVE-2025-13455.md): A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device auth (CVSS 7.3)
- [CVE-2025-13454](https://cve.now/CVE-2025-13454.md): A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sen (CVSS 6.8)
- [CVE-2025-13453](https://cve.now/CVE-2025-13453.md): A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the (CVSS 5.1)
- [CVE-2025-13154](https://cve.now/CVE-2025-13154.md): An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated loca (CVSS 6.8)
- [CVE-2025-13155](https://cve.now/CVE-2025-13155.md): An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with (CVSS 8.5)
- [CVE-2025-13152](https://cve.now/CVE-2025-13152.md): A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local au (CVSS 8.5)
- [CVE-2025-12046](https://cve.now/CVE-2025-12046.md): A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated us (CVSS 8.5)
- [CVE-2025-12048](https://cve.now/CVE-2025-12048.md): An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow (CVSS 7.7)
- [CVE-2025-12047](https://cve.now/CVE-2025-12047.md): A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, (CVSS 6.0)
- [CVE-2025-10495](https://cve.now/CVE-2025-10495.md): A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client application (CVSS 7.7)
- [CVE-2025-8485](https://cve.now/CVE-2025-8485.md): An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elev (CVSS 7.0)
- [CVE-2025-8421](https://cve.now/CVE-2025-8421.md): An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could a (CVSS 5.2)
- [CVE-2025-11193](https://cve.now/CVE-2025-11193.md): A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to s (CVSS 6.8)
- [CVE-2025-10699](https://cve.now/CVE-2025-10699.md): A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure. (CVSS 6.0)
- [CVE-2025-10581](https://cve.now/CVE-2025-10581.md): A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a lo (CVSS 8.5)
- [CVE-2025-9548](https://cve.now/CVE-2025-9548.md): A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a local authenticated (CVSS 6.8)
- [CVE-2025-8486](https://cve.now/CVE-2025-8486.md): A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with elevated privileges. (CVSS 8.5)
- [CVE-2025-6026](https://cve.now/CVE-2025-6026.md): An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable of (CVSS 2.3)
- [CVE-2025-8061](https://cve.now/CVE-2025-8061.md): A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Leno (CVSS 7.3)
- [CVE-2025-8557](https://cve.now/CVE-2025-8557.md): An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a (CVSS 8.7)
- [CVE-2025-9214](https://cve.now/CVE-2025-9214.md): A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or mo (CVSS 5.3)
- [CVE-2025-9319](https://cve.now/CVE-2025-9319.md): A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions. (CVSS 7.5)
- [CVE-2025-9201](https://cve.now/CVE-2025-9201.md): A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local use (CVSS 8.5)
- [CVE-2025-8098](https://cve.now/CVE-2025-8098.md): An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges. (CVSS 8.5)
- [CVE-2025-4371](https://cve.now/CVE-2025-4371.md): A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical acce (CVSS 7.0)
- [CVE-2025-4657](https://cve.now/CVE-2025-4657.md): A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Len (CVSS 8.4)
- [CVE-2025-6249](https://cve.now/CVE-2025-6249.md): An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions (CVSS 8.4)
- [CVE-2025-6248](https://cve.now/CVE-2025-6248.md): A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information i (CVSS 7.1)
- [CVE-2025-6232](https://cve.now/CVE-2025-6232.md): An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute co (CVSS 8.5)
- [CVE-2025-6231](https://cve.now/CVE-2025-6231.md): An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute co (CVSS 8.5)
- [CVE-2025-6230](https://cve.now/CVE-2025-6230.md): A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execu (CVSS 4.8)
- [CVE-2025-1729](https://cve.now/CVE-2025-1729.md): A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to (CVSS 5.4)
- [CVE-2025-0886](https://cve.now/CVE-2025-0886.md): An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to esc (CVSS 8.5)
- [CVE-2025-2503](https://cve.now/CVE-2025-2503.md): An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file (CVSS 6.9)
- [CVE-2025-2502](https://cve.now/CVE-2025-2502.md): An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. (CVSS 8.5)
- [CVE-2025-2501](https://cve.now/CVE-2025-2501.md): An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges. (CVSS 8.5)
- [CVE-2025-1479](https://cve.now/CVE-2025-1479.md): An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to ex (CVSS 4.8)
- [CVE-2024-11679](https://cve.now/CVE-2024-11679.md): An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker (CVSS 6.7)
- [CVE-2024-12673](https://cve.now/CVE-2024-12673.md): An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow (CVSS 7.8)
- [CVE-2024-45102](https://cve.now/CVE-2024-45102.md): A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a co (CVSS 6.8)
- [CVE-2024-10254](https://cve.now/CVE-2024-10254.md): A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker (CVSS 4.7)
- [CVE-2024-10253](https://cve.now/CVE-2024-10253.md): A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause (CVSS 4.7)
- [CVE-2024-8058](https://cve.now/CVE-2024-8058.md): An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary (CVSS 7.6)
- [CVE-2024-6001](https://cve.now/CVE-2024-6001.md): An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an up (CVSS 8.1)
- [CVE-2024-4762](https://cve.now/CVE-2024-4762.md): An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to esc (CVSS 7.8)
- [CVE-2024-33582](https://cve.now/CVE-2024-33582.md): A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileg (CVSS 7.8)
- [CVE-2024-33581](https://cve.now/CVE-2024-33581.md): A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with (CVSS 7.8)
- [CVE-2024-33580](https://cve.now/CVE-2024-33580.md): A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8)
- [CVE-2024-33579](https://cve.now/CVE-2024-33579.md): A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8)
- [CVE-2024-33578](https://cve.now/CVE-2024-33578.md): A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8)
- [CVE-2024-9046](https://cve.now/CVE-2024-9046.md): A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8)
- [CVE-2024-4132](https://cve.now/CVE-2024-4132.md): A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8)
- [CVE-2024-4131](https://cve.now/CVE-2024-4131.md): A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8)
- [CVE-2024-4130](https://cve.now/CVE-2024-4130.md): A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8)
- [CVE-2024-4089](https://cve.now/CVE-2024-4089.md): A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges. (CVSS 7.8)
- [CVE-2024-5474](https://cve.now/CVE-2024-5474.md): A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2 (CVSS 5.5)
- [CVE-2024-45105](https://cve.now/CVE-2024-45105.md): An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that cou (CVSS 6.7)
- [CVE-2024-45104](https://cve.now/CVE-2024-45104.md): A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device thr (CVSS 6.3)
- [CVE-2024-45103](https://cve.now/CVE-2024-45103.md): A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privile (CVSS 4.3)
- [CVE-2024-45101](https://cve.now/CVE-2024-45101.md): A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, (CVSS 6.8)
- [CVE-2024-8281](https://cve.now/CVE-2024-8281.md): An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform comm (CVSS 7.2)
- [CVE-2024-8280](https://cve.now/CVE-2024-8280.md): An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform comm (CVSS 7.2)
- [CVE-2024-8279](https://cve.now/CVE-2024-8279.md): A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perf (CVSS 7.2)
- [CVE-2024-8278](https://cve.now/CVE-2024-8278.md): A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perf (CVSS 7.2)
- [CVE-2024-8059](https://cve.now/CVE-2024-8059.md): IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. (CVSS 4.3)
- [CVE-2024-7756](https://cve.now/CVE-2024-7756.md): A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges b (CVSS 6.8)
- [CVE-2024-4550](https://cve.now/CVE-2024-4550.md): A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attacke (CVSS 6.7)
- [CVE-2024-3100](https://cve.now/CVE-2024-3100.md): A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated priv (CVSS 6.7)
- [CVE-2024-8105](https://cve.now/CVE-2024-8105.md): Insecure Platform Key (PK) used in UEFI system firmware signature (CVSS 6.4)
- [CVE-2024-6004](https://cve.now/CVE-2024-6004.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to d (CVSS 6.5)
- [CVE-2024-5210](https://cve.now/CVE-2024-5210.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to p (CVSS 6.5)
- [CVE-2024-5209](https://cve.now/CVE-2024-5209.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to d (CVSS 6.5)
- [CVE-2024-4782](https://cve.now/CVE-2024-4782.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to d (CVSS 6.5)
- [CVE-2024-4781](https://cve.now/CVE-2024-4781.md): A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to c (CVSS 6.5)
- [CVE-2024-4763](https://cve.now/CVE-2024-4763.md): An insecure driver vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) th (CVSS 7.8)
- [CVE-2024-2175](https://cve.now/CVE-2024-2175.md): An insecure permissions vulnerability was reported in Lenovo Display Control Center (LDCC) and Lenovo Accessories and Display Manager (LADM) (CVSS 7.8)
- [CVE-2017-3772](https://cve.now/CVE-2017-3772.md): A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot. (CVSS 5.5)
- [CVE-2019-6197](https://cve.now/CVE-2019-6197.md): A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. (CVSS 7.8)
- [CVE-2019-6198](https://cve.now/CVE-2019-6198.md): A vulnerability was reported in Lenovo PC Manager prior to version 2.8.90.11211 that could allow a local attacker to escalate privileges. (CVSS 7.8)
- [CVE-2023-1577](https://cve.now/CVE-2023-1577.md): A path hijacking vulnerability was reported in Lenovo Driver Manager prior to version 3.1.1307.1308 that could allow a local user to execute (CVSS 7.8)
- [CVE-2024-4786](https://cve.now/CVE-2024-4786.md): An improper validation vulnerability was reported in the Lenovo Tab K10 that could allow a specially crafted application to keep the device (CVSS 2.8)
- [CVE-2024-38512](https://cve.now/CVE-2024-38512.md): A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform co (CVSS 7.2)
- [CVE-2024-38511](https://cve.now/CVE-2024-38511.md): A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user (CVSS 7.2)
- [CVE-2024-38510](https://cve.now/CVE-2024-38510.md): A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user wi (CVSS 7.2)
- [CVE-2024-38509](https://cve.now/CVE-2024-38509.md): A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute ar (CVSS 7.2)
- [CVE-2024-38508](https://cve.now/CVE-2024-38508.md): A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an a (CVSS 7.2)
- [CVE-2024-4696](https://cve.now/CVE-2024-4696.md): A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system comma (CVSS 7.5)
- [CVE-2024-3286](https://cve.now/CVE-2024-3286.md): A buffer overflow vulnerability was identified in some Lenovo printers that could allow an unauthenticated user to trigger a device restart (CVSS 7.5)
- [CVE-2024-23594](https://cve.now/CVE-2024-23594.md): A buffer overflow vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operati (CVSS 6.4)
- [CVE-2024-23593](https://cve.now/CVE-2024-23593.md): A vulnerability was reported in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from (CVSS 6.7)
- [CVE-2024-2659](https://cve.now/CVE-2024-2659.md): A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to exe (CVSS 7.2)
- [CVE-2023-4857](https://cve.now/CVE-2023-4857.md): An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI ca (CVSS 7.5)
- [CVE-2023-4856](https://cve.now/CVE-2023-4856.md): A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a (CVSS 8.8)
- [CVE-2023-4855](https://cve.now/CVE-2023-4855.md): A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to exe (CVSS 7.2)
- [CVE-2024-27912](https://cve.now/CVE-2024-27912.md): A denial of service vulnerability was reported in some Lenovo Printers that could allow an attacker to cause the device to crash by sending (CVSS 7.5)
- [CVE-2024-27911](https://cve.now/CVE-2024-27911.md): A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to obtain the administrator password. (CVSS 7.5)
- [CVE-2024-27910](https://cve.now/CVE-2024-27910.md): A vulnerability was reported in some Lenovo Printers that could allow an unauthenticated attacker to reboot the printer without authenticati (CVSS 5.3)
- [CVE-2024-27909](https://cve.now/CVE-2024-27909.md): A denial of service vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in a system reboot. (CVSS 4.9)
- [CVE-2024-27908](https://cve.now/CVE-2024-27908.md): A buffer overflow vulnerability was reported in the HTTPS service of some Lenovo Printers that could result in denial of service. (CVSS 4.9)
- [CVE-2024-23592](https://cve.now/CVE-2024-23592.md): An authentication bypass vulnerability was reported in Lenovo devices with Synaptics fingerprint readers that could allow an attacker with p (CVSS 6.3)
- [CVE-2023-25494](https://cve.now/CVE-2023-25494.md): A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacke (CVSS 6.7)
- [CVE-2023-25493](https://cve.now/CVE-2023-25493.md): A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products (CVSS 6.7)
- [CVE-2023-5912](https://cve.now/CVE-2023-5912.md): A potential memory leakage vulnerability was reported in some Lenovo Notebook products that may allow a local attacker with elevated privil (CVSS 6.7)
- [CVE-2023-4605](https://cve.now/CVE-2023-4605.md): A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system (CVSS 6.5)
- [CVE-2024-23591](https://cve.now/CVE-2024-23591.md): ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an at (CVSS 2.0)
- [CVE-2023-6450](https://cve.now/CVE-2023-6450.md): An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, result (CVSS 5.5)
- [CVE-2023-6044](https://cve.now/CVE-2023-6044.md): A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Le (CVSS 6.3)
- [CVE-2023-6043](https://cve.now/CVE-2023-6043.md): A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute (CVSS 7.8)
- [CVE-2023-5081](https://cve.now/CVE-2023-5081.md): An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable (CVSS 3.3)
- [CVE-2023-5080](https://cve.now/CVE-2023-5080.md): A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identi (CVSS 6.8)
- [CVE-2023-6540](https://cve.now/CVE-2023-6540.md): A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a pay (CVSS 6.5)
- [CVE-2023-6338](https://cve.now/CVE-2023-6338.md): Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local a (CVSS 7.8)
- [CVE-2023-43577](https://cve.now/CVE-2023-43577.md): A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privilege (CVSS 6.7)
- [CVE-2023-43576](https://cve.now/CVE-2023-43576.md): A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileg (CVSS 6.7)
- [CVE-2023-43575](https://cve.now/CVE-2023-43575.md): A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevate (CVSS 6.7)
- [CVE-2023-43574](https://cve.now/CVE-2023-43574.md): A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacke (CVSS 4.4)
- [CVE-2023-43573](https://cve.now/CVE-2023-43573.md): A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker (CVSS 6.7)
- [CVE-2023-43572](https://cve.now/CVE-2023-43572.md): A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with eleva (CVSS 4.4)
- [CVE-2023-45079](https://cve.now/CVE-2023-45079.md): A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to (CVSS 6.7)
- [CVE-2023-45078](https://cve.now/CVE-2023-45078.md): A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to (CVSS 6.7)
- [CVE-2023-45077](https://cve.now/CVE-2023-45077.md): A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to (CVSS 6.7)
- [CVE-2023-45076](https://cve.now/CVE-2023-45076.md): A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to (CVSS 6.7)
- [CVE-2023-45075](https://cve.now/CVE-2023-45075.md): A memory leakage vulnerability was reported in the SWSMI\_Shadow DXE driver that may allow a local attacker with elevated privileges to write (CVSS 6.7)
- [CVE-2023-43581](https://cve.now/CVE-2023-43581.md): A buffer overflow was reported in the Update\_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privil (CVSS 6.7)
- [CVE-2023-43580](https://cve.now/CVE-2023-43580.md): A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated priv (CVSS 6.7)
- [CVE-2023-43579](https://cve.now/CVE-2023-43579.md): A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privile (CVSS 6.7)
- [CVE-2023-43578](https://cve.now/CVE-2023-43578.md): A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileg (CVSS 6.7)
- [CVE-2023-43571](https://cve.now/CVE-2023-43571.md): A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevat (CVSS 6.7)
- [CVE-2023-43570](https://cve.now/CVE-2023-43570.md): A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated perm (CVSS 6.7)
- [CVE-2023-43569](https://cve.now/CVE-2023-43569.md): A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges (CVSS 6.7)
- [CVE-2023-43568](https://cve.now/CVE-2023-43568.md): A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with ele (CVSS 4.4)
- [CVE-2023-43567](https://cve.now/CVE-2023-43567.md): A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elev (CVSS 6.7)
- [CVE-2023-5079](https://cve.now/CVE-2023-5079.md): Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could resul (CVSS 7.5)
- [CVE-2023-5078](https://cve.now/CVE-2023-5078.md): A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIO (CVSS 6.7)
- [CVE-2023-5075](https://cve.now/CVE-2023-5075.md): A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated (CVSS 6.7)
- [CVE-2023-4891](https://cve.now/CVE-2023-4891.md): A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service. (CVSS 5.5)
- [CVE-2023-4706](https://cve.now/CVE-2023-4706.md): A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user acco (CVSS 7.3)
- [CVE-2023-4632](https://cve.now/CVE-2023-4632.md): An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute cod (CVSS 7.8)
- [CVE-2022-4575](https://cve.now/CVE-2022-4575.md): A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker (CVSS 6.7)
- [CVE-2022-48189](https://cve.now/CVE-2022-48189.md): An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated priv (CVSS 6.7)
- [CVE-2022-4574](https://cve.now/CVE-2022-4574.md): An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated pr (CVSS 6.7)
- [CVE-2022-4573](https://cve.now/CVE-2022-4573.md): An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileg (CVSS 6.7)
- [CVE-2022-3702](https://cve.now/CVE-2022-3702.md): A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local a (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/lenovo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.