Lenovo vulnerabilities
401 CVEs and advisories name Lenovo as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-4608An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.
- CVE-2023-4607An authenticated XCC user can change permissions for any user through a crafted API command.
- CVE-2023-4606An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.
- CVE-2022-48183 A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under
- CVE-2022-48182 A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under
- CVE-2022-3728 A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under
- CVE-2022-3431A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not dea
- CVE-2022-3746A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat
- CVE-2022-3745A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat
- CVE-2022-3744A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat
- CVE-2022-3743A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat
- CVE-2022-3742A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat
- CVE-2023-34419A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local acc
- CVE-2023-4030A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to
- CVE-2023-4029A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with loc
- CVE-2023-4028A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker w
- CVE-2023-3078An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local a
- CVE-2023-34422A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafte
- CVE-2023-34421A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call
- CVE-2023-34420A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web
- CVE-2023-34418A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vuln
- CVE-2023-3113An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resul
- CVE-2023-2993A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a lim
- CVE-2023-2992An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under
- CVE-2023-2290A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to e
- CVE-2022-48188A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with
- CVE-2022-48181An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access t
- CVE-2022-4569A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with lo
- CVE-2022-48186A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.
- CVE-2022-4568A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.