Vulnerabilities > Lenovo

DATE CVE VULNERABILITY TITLE RISK
2023-06-26 CVE-2023-34422 Improper Input Validation vulnerability in Lenovo Xclarity Administrator
A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation.
network
low complexity
lenovo CWE-20
6.5
2023-06-26 CVE-2023-3113 XXE vulnerability in Lenovo Xclarity Administrator
An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.
network
low complexity
lenovo CWE-611
7.5
2023-06-05 CVE-2022-48181 Out-of-bounds Write vulnerability in Lenovo products
An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute arbitrary code.
local
low complexity
lenovo CWE-787
7.8
2023-06-05 CVE-2022-48188 Out-of-bounds Write vulnerability in Lenovo products
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
local
low complexity
lenovo CWE-787
7.8
2023-06-05 CVE-2022-4569 Unspecified vulnerability in Lenovo Thinkpad Hybrid Usb-C With Usb-A Dock Firmware
A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execute code with elevated privileges during the package upgrade or installation.
local
low complexity
lenovo
7.8
2023-05-01 CVE-2022-48186 Improper Certificate Validation vulnerability in Lenovo Baiying
A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.
network
low complexity
lenovo CWE-295
7.5
2023-05-01 CVE-2022-4568 Incorrect Default Permissions vulnerability in Lenovo System Update
A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.
local
low complexity
lenovo CWE-276
7.8
2023-05-01 CVE-2023-0683 Unspecified vulnerability in Lenovo products
A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.
network
low complexity
lenovo
8.8
2023-05-01 CVE-2023-25492 Use of Externally-Controlled Format String vulnerability in Lenovo products
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API.
network
low complexity
lenovo CWE-134
8.8
2023-05-01 CVE-2023-0896 Unspecified vulnerability in Lenovo Smart Clock Essential With Alexa Built in Firmware
A default password was reported in Lenovo Smart Clock Essential with Alexa Built In that could allow unauthorized device access to an attacker with local network access.
low complexity
lenovo
8.8