Design/Logic Flaw

A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...

CVE-2022-3430

A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...

CVE-2022-3430

A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...

CVE-2022-3430

Summary (CVE-2022-3430) : The vulnerability concerns the Lenovo WMI Setup driver on Lenovo Notebook devices. It could let an attacker with elevated privileges modify the Secure Boot setting by changing an NVRAM variable. The PT-2022-6630 entry notes the issue relates to errors in using standard p...

CVE-2022-1892

A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code...

CVE-2022-1892

A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code...

CVE-2022-1892

CVE-2022-1892: A buffer overflow in Lenovo SystemBootManagerDxe (and related ReadyBootDxe/SystemLoadDefaultDxe drivers) is caused by insufficient validation of the DataSize NVRAM variable, enabling local privilege escalation and arbitrary code execution on affected Lenovo Notebook firmware. Mitig...

CVE-2022-1891

CVE-2022-1891 concerns a buffer overflow in Lenovo Notebook firmware, specifically the SystemLoadDefaultDxe driver (also involving ReadyBootDxe and SystemBootManagerDxe). The root cause is insufficient validation of an NVRAM DataSize variable, enabling local privilege escalation to arbitrary code...

CVE-2022-1891

A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code...

CVE-2022-1891

A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code...

CVE-2022-1890

CVE-2022-1890 affects Lenovo Notebook products via a buffer overflow in the ReadyBootDxe driver (and related drivers ReadyBootDxe/SystemLoadDefaultDxe/SystemBootManagerDxe). The root cause is insufficient validation of an NVRAM variable (DataSize), enabling local-privilege arbitrary code executio...

CVE-2022-1890

A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code...

Lenovo Notebook 安全漏洞

Lenovo Notebook is a laptop computer from Lenovo, a Chinese company. The Lenovo Notebook suffers from a security vulnerability that stems from a potential flaw in the WMI installation driver, which could allow an attacker with elevated privileges to modify the secure boot settings by modifying th...

CVE-2022-1890: Heap-based Buffer Overflow

A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code...

CVE-2022-1891: Heap-based Buffer Overflow

A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code...

CVE-2022-1892: Heap-based Buffer Overflow

A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code...

CVE-2022-3430: Incorrect Default Permissions

A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...

Apache Zeppelin input validation error vulnerability

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. Apache Zeppelin is vulnerable to an input validation error that results from improper input validation in its Move folder to Trash...

CVE-2022-4020

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable...

Design/Logic Flaw

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot settings by modifying an NVRAM variable...