Browse CVEs

MEDIUM 5.5 CVE-2022-1110 A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of service. Smart Standby Driver 4.1.50.0+ Fix from $1,6002022-05-18 MEDIUM 5.3 CVE-2021-3956 A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting… Xclarity Controller 1.51_tgbt24l / 2.32_psi342n+ Fix from $1,6002022-05-18 MEDIUM 5.3 CVE-2021-42848 An information disclosure vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to retrie… A1 Firmware 5.3.6.t1 / 5.3.6.a1+ Fix from $1,6002022-05-18 MEDIUM 5.3 CVE-2021-42851 A vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an unauthenticated user to create a standard user account. A1 Firmware 5.3.6.t1 / 5.3.6.a1+ Fix from $1,6002022-05-18 HIGH 7.0 CVE-2021-3922 A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation, prior to version 1.1.20.3 th… System Interface Foundation 1.1.20.3+ Fix from $1,9502022-05-18 HIGH 7.8 CVE-2022-0192 A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation. Pcmanager 4.0.40.2175+ Fix from $1,9502022-04-22 HIGH 7.8 CVE-2022-0354 A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with el… System Update 2022-02-25+ Fix from $1,9502022-04-22 MEDIUM 6.7 CVE-2021-4211 A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models… A340 22icb Firmware Mitigation only Fix from $1,6002022-04-22 MEDIUM 6.7 CVE-2021-4212 A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with … C340 14iml Firmware Patch available Fix from $1,6002022-04-22 MEDIUM 6.7 CVE-2022-1107 During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some… Thinkpad 11e Firmware Mitigation only Fix from $1,6002022-04-22 MEDIUM 6.7 CVE-2022-1108 A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploite… Thinkpad X1 Fold Gen 1 Firmware Mitigation only Fix from $1,6002022-04-22 MEDIUM 5.5 CVE-2022-0636 A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash. Thin Installer 1.3.0039+ Fix from $1,6002022-04-22 CRITICAL 9.8 CVE-2021-3849 An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Mo… Nextscale N1200 Enclosure Firmware 44a-3.70+ Fix from $2,3002022-04-22 CRITICAL 9.8 CVE-2021-3897 An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management … Nextscale N1200 Enclosure Firmware 44a-3.70+ Fix from $2,3002022-04-22 MEDIUM 6.7 CVE-2021-3970 A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with… Ideapad 3 14ada05 Firmware Mitigation only Fix from $1,6002022-04-22 MEDIUM 6.7 CVE-2021-3971 A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included… Ideapad 3 14ada05 Firmware Mitigation only Fix from $1,6002022-04-22 MEDIUM 6.7 CVE-2021-3972 A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deacti… Ideapad 3 14ada05 Firmware Mitigation only Fix from $1,6002022-04-22 MEDIUM 6.7 CVE-2021-4210 A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow a… Stadia Ggp 120 Firmware Patch available Fix from $1,6002022-04-22 MEDIUM 5.5 CVE-2021-3721 A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.20.10282 that could allow an attacker with local access to tr… Pcmanager 4.0.10282+ Fix from $1,6002022-04-22 MEDIUM 5.0 CVE-2021-3722 A denial of service vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow configuration files to be written to… Pcmanager 4.0.40.2175+ Fix from $1,6002022-04-22 HIGH 8.8 CVE-2021-3840 A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execut… Antilles 1.0.1+ Fix from $1,9502021-11-12 MEDIUM 6.7 CVE-2021-3843 A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privilege… Thinkpad 11e 3rd Gen Firmware after 1.31 Fix from $1,6002021-11-12 MEDIUM 5.5 CVE-2021-3720 An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L70081) th… Legion Phone Pro \(l79031\)firmware 12.5.231 / 12.5.632+ Fix from $1,6002021-11-12 MEDIUM 5.5 CVE-2021-3786 A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak … Thinkpad X380 Yoga Firmware 2020-10-31 / 2021-10-25+ Fix from $1,6002021-11-12 MEDIUM 6.8 CVE-2021-3519 A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Dev… Ideacentre C5 14mb05 Firmware Mitigation only Fix from $1,6002021-11-12 MEDIUM 6.7 CVE-2021-3599 A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access an… Thinkpad X380 Yoga Firmware 2020-10-31 / 2021-10-25+ Fix from $1,6002021-11-12 MEDIUM 6.7 CVE-2021-3719 A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCent… Thinkcentre E93 Firmware Mitigation only Fix from $1,6002021-11-12 CRITICAL 9.8 CVE-2021-3616 A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware … Smart Camera C2e Firmware 01.03.29.16+ Fix from $2,3002021-08-17 HIGH 7.8 CVE-2021-3633 A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation. Drivers Management 2.9.0719.1104+ Fix from $1,9502021-08-17 HIGH 7.2 CVE-2021-3617 A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configu… Smart Camera C2e Firmware 01.03.29.16+ Fix from $1,9502021-08-17