Filtered by vendor Lenovo Subscriptions
Total 420 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-2659 1 Lenovo 138 Fan Power Controller, Nextscale N1200 Enclosure, Nextscale N1200 Enclosure Firmware and 135 more 2025-08-27 7.2 High
A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system commands when performing a specific administrative function.
CVE-2025-8098 1 Lenovo 1 Pcmanager 2025-08-21 7.8 High
An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges.
CVE-2025-6230 1 Lenovo 2 Commercial Vantage, Vantage 2025-08-19 5.3 Medium
A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite commands.
CVE-2017-5638 7 Apache, Arubanetworks, Hp and 4 more 13 Struts, Clearpass Policy Manager, Server Automation and 10 more 2025-07-30 9.8 Critical
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
CVE-2021-3453 1 Lenovo 42 730s-13iml, 730s-13iml Firmware, Ideacentre Aio 5-24imb05 and 39 more 2025-07-24 6.8 Medium
Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.
CVE-2024-23591 1 Lenovo 2 Thinksystem Sr670 V2, Thinksystem Sr670 V2 Firmware 2025-07-23 2 Low
ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with privileged logical access to the host or physical access to server internals to modify or disable Intel Boot Guard firmware integrity, SPS security, and other SPS configuration setting. The server’s NIST SP 800-193-compliant Platform Firmware Resiliency (PFR) security subsystem significantly mitigates this issue.
CVE-2025-6232 1 Lenovo 2 Commercial Vantage, Vantage 2025-07-22 7.8 High
An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying specific registry locations.
CVE-2025-6231 1 Lenovo 2 Commercial Vantage, Vantage 2025-07-22 7.8 High
An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying an application configuration file.
CVE-2023-25493 1 Lenovo 1 Bios 2025-07-13 6.7 Medium
A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a local user with elevated privileges to execute arbitrary code.
CVE-2024-12673 1 Lenovo 1 Vantage 2025-07-13 7.8 High
An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow a local attacker to elevate privileges on the system. This vulnerability only affects Vantage installed on these devices: * Lenovo V Series (Gen 5) * ThinkBook 14 (Gen 6, 7) * ThinkBook 16 (Gen 6, 7) * ThinkPad E Series (Gen 1)
CVE-2024-4696 1 Lenovo 1 Service Bridge 2025-07-13 7.5 High
A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system commands to be executed if a specially crafted link is visited.
CVE-2023-4605 1 Lenovo 1 Xclarity Administrator 2025-07-13 6.5 Medium
A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information.
CVE-2024-45102 1 Lenovo 1 Xclarity Administrator 2025-07-13 6.8 Medium
A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instance when using LXCA as a Single Sign On (SSO) provider for XCC instances.
CVE-2023-5912 1 Lenovo 1 Notebook 2025-07-13 6.7 Medium
A potential memory leakage vulnerability was reported in some Lenovo Notebook products that may allow a local attacker with elevated privileges to write to NVRAM variables.
CVE-2024-6001 1 Lenovo 1 Accessories And Display Manager 2025-07-12 8.1 High
An improper certificate validation vulnerability was reported in LADM that could allow a network attacker with the ability to redirect an update request to a remote server and execute code with elevated privileges.
CVE-2023-6043 1 Lenovo 1 Vantage 2025-06-18 7.8 High
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code with elevated privileges.
CVE-2023-5080 1 Lenovo 12 Tab M10 Plus Gen 3 Tb125fu, Tab M10 Plus Gen 3 Tb125fu Firmware, Tab M8 Hd Tb8505f and 9 more 2025-06-18 6.8 Medium
A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system commands.
CVE-2023-6540 1 Lenovo 2 Browser Hd, Browser Mobile 2025-06-17 6.5 Medium
A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could result in the disclosure of sensitive information.
CVE-2023-6338 1 Lenovo 1 Universal Device Client 2025-06-03 7.8 High
Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.
CVE-2015-4596 1 Lenovo 1 Mouse Suite 2025-05-30 N/A
Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges.