CveMateVulnerability intelligence

Lenovo vulnerabilities, page 3

529 vulnerabilities

Known vulnerabilities in Lenovo products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3,161 products.

CVE-2018-9068ibm corporationsystem x imm2+438y ago26-07-2018 19:00

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI.CVE-2018-9073lenovochassis_management_module_firmware+17y ago16-11-2018 14:00

Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.CVE-2018-12169intelcore_i3_firmware+318y ago21-09-2018 20:00

Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation Intel Core Processor and 8th Generation Intel Core Processor contains a logic error which may allow physical attacker to potentially bypass firmware authentication.CVE-2013-1361lenovothinkpad_bluetooth_with_enhanced_data_rate_software12y ago21-01-2014 18:00

Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate Software 6.4.0.2900 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as a file that is processed by Lenovo Bluetooth.CVE-2021-42850lenovoa1_firmware+94y ago18-05-2022 16:10

A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.CVE-2021-42205lenovoelan_miniport_touchpad_driver3y ago07-11-2022 00:00

ELAN Miniport touchpad Windows driver before 24.21.51.2, as used in PC hardware from multiple manufacturers, allows local users to cause a system crash by sending a certain IOCTL request, because that request is handled twice.CVE-2021-42848lenovoa1_firmware+94y ago18-05-2022 16:10

An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrieve device and networking details.CVE-2021-42851lenovoa1_firmware+94y ago18-05-2022 16:10

A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account.CVE-2021-42852lenovoa1_firmware+94y ago18-05-2022 16:10

A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.CVE-2021-42849lenovoa1_firmware+94y ago18-05-2022 16:10

A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.CVE-2021-4212lenovobios+624y ago22-04-2022 20:30

A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.CVE-2021-4210lenovoa540-24icb_firmware+324y ago22-04-2022 20:30

A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.CVE-2021-4211lenovoa340-22icb_firmware+534y ago22-04-2022 20:30

A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.CVE-2021-3843lenovothinkpad_11e_3rd_gen_firmware+294y ago12-11-2021 22:05

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.CVE-2021-3719lenovothinkcentre and thinkstation bios+204y ago12-11-2021 22:05

A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.CVE-2021-3599lenovoideapad_s940-14iwl_firmware+1334y ago12-11-2021 22:05

A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.CVE-2021-3969lenovoimcontroller+14y ago18-05-2022 16:10

A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3that could allow a local attacker to elevate privileges.CVE-2021-3849ibmnextscale_fan_power_controller_firmware+64y ago22-04-2022 21:10

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.CVE-2021-3786lenovoideapad_s940-14iwl_firmware+1334y ago12-11-2021 22:05

A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.CVE-2021-3616lenovosmart_camera_c2e_firmware+35y ago17-08-2021 16:25

A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651.