Lenovo vulnerabilities
401 CVEs and advisories name Lenovo as an affected vendor, newest first. Follow it as a feed.
- CVE-2023-0683A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.
- CVE-2023-25492A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a f
- CVE-2023-0896A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attack
- CVE-2023-25495A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authen
- CVE-2023-25496A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to execut
- CVE-2023-29056A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC.
- CVE-2023-29057A valid XCC user's local account permissions overrides their active directory permissions under specific configurations.
- CVE-2023-29058A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message
- CVE-2022-34888The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not norma
- CVE-2022-34884A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subs
- CVE-2022-40137A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute ar
- CVE-2022-40136An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker wi
- CVE-2022-40135An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and
- CVE-2022-40134An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and
- CVE-2022-4816A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application.
- CVE-2022-3432A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may al
- CVE-2022-3430A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to
- CVE-2022-1892A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute
- CVE-2022-1891A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute
- CVE-2022-1890A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitra
- CVE-2022-1109An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service.
- CVE-2022-4435A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoRemoteConfigUpdateDxe driver that could allow a local attacker
- CVE-2022-4434A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS driver that could allow a local attacker with elevated privileges to
- CVE-2022-4433A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with el
- CVE-2022-4432A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with el
- CVE-2022-1513A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specia
- CVE-2022-1110A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of ser
- CVE-2021-42852A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execu
- CVE-2021-42851A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard use
- CVE-2021-42850A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that