Lenovo Security Vulnerabilities
A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
6.7CVSS
6.3AI Score
0.0004EPSS
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
6.7CVSS
6.3AI Score
0.0004EPSS
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
6.7CVSS
6.3AI Score
0.0004EPSS
A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
6.7CVSS
6.3AI Score
0.0004EPSS
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
8.1CVSS
7.9AI Score
0.001EPSS
An authenticated XCC user can change permissions for any user through a crafted API command.
8.8CVSS
8.4AI Score
0.001EPSS
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
7.2CVSS
7.3AI Score
0.001EPSS
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges.
7.8CVSS
7.6AI Score
0.0004EPSS
A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrect default privileges.
7.8CVSS
7.7AI Score
0.0004EPSS
A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service.
5.5CVSS
5.5AI Score
0.0004EPSS
A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated privileges to execute arbitrary code.
6.7CVSS
6.9AI Score
0.0004EPSS
A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware.
6.7CVSS
6.2AI Score
0.0004EPSS
Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure.
7.5CVSS
7.4AI Score
0.001EPSS
A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system commands.
7.8CVSS
7.6AI Score
0.0004EPSS
An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier.
3.3CVSS
3.7AI Score
0.0004EPSS
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code with elevated privileges.
7.8CVSS
7.9AI Score
0.0004EPSS
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Service and execute arbitrary code with elevated privileges.
6.8CVSS
6.8AI Score
0.001EPSS
Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.
7.8CVSS
7.8AI Score
0.0004EPSS
An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of service.
5.5CVSS
5.4AI Score
0.0004EPSS
A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could result in the disclosure of sensitive information.
7.5CVSS
7.2AI Score
0.001EPSS
A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges.
4.3CVSS
4.8AI Score
0.0004EPSS
A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call.
6.5CVSS
6.4AI Score
0.0005EPSS