Lenovo
lenovo
406 CVEs • 4,477 products
Products (4,477)
Click to collapseToggle
Products (4,477)
Click to collapse
CVEs (406)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Lenovo 4Thinkpad P14s Gen 2 Firmware Thinkpad P15s Gen 2 FirmwareThinkpad T14 Gen 2 Firmware+1 moreJun 17, 2026 Aug 17, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt. |
1Lenovo 26K14 Type 21cu Firmware K14 Type 21cv FirmwareThinkpad E14 Gen 3 Firmware+23 moreJun 17, 2026 Aug 17, 2023 N/A· v4 6.7 MEDIUM· v3 N/A· v2 A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code. |
1Lenovo 2913w Yoga Firmware 13w Yoga Gen 2 FirmwareFlex 5 14alc05 Firmware+26 moreJun 17, 2026 Aug 17, 2023 N/A· v4 6.7 MEDIUM· v3 N/A· v2 A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code. |
An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges. |
1Lenovo 30Legion 5 15ach6 Firmware Legion 5 15ach6a FirmwareLegion 5 15ach6h Firmware+27 moreJun 17, 2026 Aug 17, 2023 N/A· v4 6.7 MEDIUM· v3 N/A· v2 A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code. |
An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files. |
A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation. |
A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation. |
A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. |
A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API. |
1Lenovo 8Nextscale N1200 Enclosure Firmware Thinkagile Cp Cb 10 FirmwareThinkagile Cp Cb 10e Firmware+5 moreJun 17, 2026 Jun 26, 2023 N/A· v4 6.3 MEDIUM· v3 N/A· v2 A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normal...Show more |
1Lenovo 8Nextscale N1200 Enclosure Firmware Thinkagile Cp Cb 10 FirmwareThinkagile Cp Cb 10e Firmware+5 moreJun 17, 2026 Jun 26, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management...Show more |
1Lenovo 85Thinkpad E14 Firmware Thinkpad E14 Gen 2 FirmwareThinkpad E14 Gen 4 Firmware+82 moreJun 17, 2026 Jun 26, 2023 N/A· v4 6.7 MEDIUM· v3 N/A· v2 A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to execute arbitrary code. |
1Lenovo 27Ideacentre 510s 07icb Firmware Ideacentre 510s 07ick FirmwareIdeacentre 720 18apr Firmware+24 moreJun 17, 2026 Jun 5, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code. |
1Lenovo 114Ideacentre 3 07ada05 Firmware Ideacentre 3 07imb05 FirmwareIdeacentre 3 07ach7 Firmware+111 moreJun 17, 2026 Jun 5, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute arbitrary code. |
1Lenovo 1Thinkpad Hybrid Usb C With Usb A Dock Firmware Jun 17, 2026 Jun 5, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execute code with elevated privileges during the package upgrade o...Show more |
1Lenovo 109Thinkagile Hx1021 Firmware Thinkagile Hx1320 FirmwareThinkagile Hx1321 Firmware+106 moreJun 17, 2026 May 1, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API. |
1Lenovo 109Thinkagile Hx1021 Firmware Thinkagile Hx1320 FirmwareThinkagile Hx1321 Firmware+106 moreJun 17, 2026 May 1, 2023 N/A· v4 8.8 HIGH· v3 N/A· v2 A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call. |
A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges. |
A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure. |