Vulnerabilities > Lenovo

DATE CVE VULNERABILITY TITLE RISK
2020-11-30 CVE-2020-8351 Improper Privilege Management vulnerability in Lenovo Pcmanager
A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an authenticated user to execute code with elevated privileges.
local
low complexity
lenovo CWE-269
4.6
2020-11-11 CVE-2020-8354 Unspecified vulnerability in Lenovo Notebook Firmware
A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook models may allow arbitrary code execution.
local
low complexity
lenovo
7.2
2020-11-11 CVE-2020-8353 Unspecified vulnerability in Lenovo products
Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled.
local
low complexity
lenovo
4.6
2020-11-11 CVE-2020-8352 Unspecified vulnerability in Lenovo products
In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.
local
low complexity
lenovo
2.1
2020-10-14 CVE-2020-8350 Improper Authentication vulnerability in Lenovo Thinkpad Stack Wireless Router Firmware
An authentication bypass vulnerability was reported in Lenovo ThinkPad Stack Wireless Router firmware version 1.1.3.4 that could allow escalation of privilege.
low complexity
lenovo CWE-287
5.8
2020-10-14 CVE-2020-8349 Code Injection vulnerability in Lenovo Cloud Networking Operating System
An internal security review has identified an unauthenticated remote code execution vulnerability in Cloud Networking Operating System (CNOS)’ optional REST API management interface.
network
lenovo CWE-94
6.8
2020-10-14 CVE-2020-8345 Uncontrolled Search Path Element vulnerability in Lenovo Hardware Scan
A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege.
local
lenovo CWE-427
4.4
2020-10-14 CVE-2020-8338 Untrusted Search Path vulnerability in Lenovo Diagnostics
A DLL search path vulnerability was reported in Lenovo Diagnostics prior to version 4.35.4 that could allow a user with local access to execute code on the system.
local
low complexity
lenovo CWE-426
7.2
2020-10-14 CVE-2020-8332 Time-Of-Check Time-Of-Use (Toctou) Race Condition vulnerability in Lenovo products
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution.
local
lenovo CWE-367
6.9
2020-09-24 CVE-2020-8348 Cross-Site Scripting vulnerability in Lenovo Enterprise Network Disk 6.1
A DOM-based cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's current browser session if a crafted url is visited, possibly through phishing.
network
lenovo CWE-79
4.3