Lenovo vulnerabilities
401 CVEs and advisories name Lenovo as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-2503An improper permission handling vulnerability was reported in Lenovo PC Manager that could allow a local attacker to perform arbitrary file
- CVE-2025-2502An improper default permissions vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.
- CVE-2025-2501An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.
- CVE-2025-1479An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to ex
- CVE-2024-11679An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker
- CVE-2024-12673An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow
- CVE-2024-45102A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a co
- CVE-2024-10254A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker
- CVE-2024-10253A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause
- CVE-2024-8058An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary
- CVE-2024-6001An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an up
- CVE-2024-4762An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to esc
- CVE-2024-33582A DLL hijack vulnerability was reported in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileg
- CVE-2024-33581A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with
- CVE-2024-33580A DLL hijack vulnerability was reported in Lenovo Personal Cloud that could allow a local attacker to execute code with elevated privileges.
- CVE-2024-33579A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges.
- CVE-2024-33578A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges.
- CVE-2024-9046A DLL hijack vulnerability was reported in Lenovo stARstudio that could allow a local attacker to execute code with elevated privileges.
- CVE-2024-4132A DLL hijack vulnerability was reported in Lenovo Lock Screen that could allow a local attacker to execute code with elevated privileges.
- CVE-2024-4131A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges.
- CVE-2024-4130A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges.
- CVE-2024-4089A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges.
- CVE-2024-5474A potential information disclosure vulnerability was reported in Lenovo's packaging of Dolby Vision Provisioning software prior to version 2
- CVE-2024-45105An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that cou
- CVE-2024-45104A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device thr
- CVE-2024-45103A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privile
- CVE-2024-45101A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid,
- CVE-2024-8281An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform comm
- CVE-2024-8280An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform comm
- CVE-2024-8279A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perf