| CVE-2019-6187 | 中危6.5 | A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted fo | 20/11/2019 |
| CVE-2019-6186 | 高危8.8 | A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an authenticated user to execute code as another user. | 20/11/2019 |
| CVE-2019-6184 | 高危7.8 | A potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software version 2.0.21.1 may allow local privilege escalation. | 20/11/2019 |
| CVE-2019-6175 | 高危7.5 | A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-standard locations. | 26/09/2019 |
| CVE-2019-6182 | 中危4.9 | A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to store malformed data in LXCA Jobs and Event Log data, that could result in crafted formulas stored in an exported CSV file. The crafted formula is not executed on | 03/09/2019 |
| CVE-2019-6181 | 中危6.1 | A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow a crafted URL, if visited, to cause JavaScript code to be executed in the user's web browser. The JavaScript code is not executed on LXCA itself. | 03/09/2019 |
| CVE-2019-6180 | 中危4.8 | A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to cause JavaScript code to be stored in LXCA which may then be executed in the user's web browser. The JavaScript code is not executed on LXCA itself. | 03/09/2019 |
| CVE-2019-6179 | 高危7.5 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator (LXCI) for Microsoft System Center prior to version 7.7.0, and Lenovo XClarity Integrator (LXCI) for VMWare vCenter prior to version 6.1.0 that could allow infor | 03/09/2019 |
| CVE-2019-6177 | 严重9.8 | A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to non-standard locations, potentially leading to privilege escalation. Lenovo ended support for Lenovo Solution Center and recommended that customers migrate to Lenovo Vantage or Leno | 21/08/2019 |
| CVE-2019-6169 | 高危7.5 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP. | 26/06/2019 |
| CVE-2019-6168 | 严重9.8 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. | 26/06/2019 |
| CVE-2019-6167 | 严重9.8 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. | 26/06/2019 |
| CVE-2019-6166 | 高危8.8 | A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery. | 26/06/2019 |
| CVE-2019-6163 | 高危7.5 | A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations. | 26/06/2019 |
| CVE-2019-6158 | 中危5.9 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x. | 03/05/2019 |
| CVE-2019-6154 | 高危7.8 | A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system. | 10/04/2019 |
| CVE-2019-6149 | 中危6.7 | An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges. | 18/03/2019 |
| CVE-2018-16098 | 高危7.8 | In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user. | 24/01/2019 |
| CVE-2018-9072 | 中危6.5 | In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads. | 30/11/2018 |
| CVE-2018-16097 | 中危6.5 | LXCI for VMware versions prior to 5.5 and LXCI for Microsoft System Center versions prior to 3.5, allow an authenticated user to write to any system file due to insufficient sanitization during the upload of a certificate. | 30/11/2018 |