| CVE-2023-6044 | MEDIO6.8 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Service and execute arbitrary code with elevated privileges. | 19/01/2024 |
| CVE-2023-6043 | ALTO7.8 | A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code with elevated privileges. | 19/01/2024 |
| CVE-2023-6540 | ALTO7.5 | A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could result in the disclosure of sensitive information. | 03/01/2024 |
| CVE-2023-6338 | ALTO7.8 | Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges. | 03/01/2024 |
| CVE-2023-5079 | ALTO7.5 | Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure.
| 08/11/2023 |
| CVE-2023-4891 | MEDIO5.5 |
A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service.
| 08/11/2023 |
| CVE-2023-4632 | ALTO7.8 | An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges. | 08/11/2023 |
| CVE-2022-3702 | ALTO7.1 |
A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local attacker to delete contents of an arbitrary directory under certain conditions.
| 27/10/2023 |
| CVE-2022-3701 | ALTO7.8 |
A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a local attacker to execute arbitrary code with elevated privileges.
| 27/10/2023 |
| CVE-2022-3700 | MEDIO6.3 | A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files. | 27/10/2023 |
| CVE-2022-3611 | ALTO7.5 | An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications. | 27/10/2023 |
| CVE-2022-3699 | ALTO7.8 |
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45
that could allow a local user to execute code with elevated privileges. | 25/10/2023 |
| CVE-2022-3698 | MEDIO4.4 |
A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to
1.3.1.2
and
Lenovo Diagnostics versions prior to 4.45
that could allow a local user with administrative access to trigger a system crash.
| 25/10/2023 |
| CVE-2022-0353 | MEDIO4.4 |
A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to
1.3.1.2
and
Lenovo Diagnostics versions prior to 4.45
that could allow a local user with administrative access to trigger a system crash.
| 25/10/2023 |
| CVE-2023-3078 | ALTO7.8 | An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges. | 17/08/2023 |
| CVE-2023-3113 | ALTO7.5 | An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files. | 26/06/2023 |
| CVE-2023-34422 | MEDIO6.5 | A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation. | 26/06/2023 |
| CVE-2023-34421 | MEDIO6.5 | A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation. | 26/06/2023 |
| CVE-2023-34420 | ALTO7.2 | A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. | 26/06/2023 |
| CVE-2023-34418 | ALTO8.1 | A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API. | 26/06/2023 |