Vulnerabilities > Lenovo

DATE CVE VULNERABILITY TITLE RISK
2022-05-18 CVE-2021-3922 Race Condition vulnerability in Lenovo System Interface Foundation
A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 that could allow a local attacker to connect and interact with the IMController child process' named pipe.
local
lenovo CWE-362
4.4
2022-05-18 CVE-2021-3956 Incorrect Authorization vulnerability in Lenovo Xclarity Controller
A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory.
network
lenovo CWE-863
4.3
2022-05-18 CVE-2021-3969 Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Lenovo System Interface Foundation
A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3that could allow a local attacker to elevate privileges.
local
lenovo CWE-367
4.4
2022-05-18 CVE-2021-42848 Missing Authorization vulnerability in Lenovo products
An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.
network
low complexity
lenovo CWE-862
5.0
2022-05-18 CVE-2021-42849 Use of Hard-coded Credentials vulnerability in Lenovo products
A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.
local
low complexity
lenovo CWE-798
4.6
2022-05-18 CVE-2021-42850 Use of Hard-coded Credentials vulnerability in Lenovo products
A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.
local
low complexity
lenovo CWE-798
4.6
2022-05-18 CVE-2021-42851 Unspecified vulnerability in Lenovo products
A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.
network
low complexity
lenovo
5.0
2022-05-18 CVE-2021-42852 OS Command Injection vulnerability in Lenovo products
A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.
low complexity
lenovo CWE-78
7.7
2022-05-18 CVE-2022-1110 Classic Buffer Overflow vulnerability in Lenovo Smart Standby Driver
A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of service.
local
low complexity
lenovo CWE-120
4.9
2022-04-22 CVE-2021-3721 Out-of-bounds Write vulnerability in Lenovo Pcmanager
A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local access to trigger a blue screen error.
local
low complexity
lenovo CWE-787
4.9