CVE-2023-25492

< 8.88_cdi3a4a

A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior t

6.3MEDIUM

CVE-2023-0683

< 8.88_cdi3a4a

A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.

8.3HIGH

CVE-2023-29056

< 8.88_cdi3a4a

A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable

5.3MEDIUM

CVE-2023-25495

< 8.88_cdi3a4a

A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC

4.9MEDIUM

CVE-2023-29058

< 8.88_cdi3a4a

A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespa

6.4MEDIUM

CVE-2023-29057

< 8.88_cdi3a4a

A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This coul

7.3HIGH

CVE-2022-40136

< s05kt62a

An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an a

4.4MEDIUM

CVE-2022-34888

< 8.40-cdi394n

The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may

2.7LOW

CVE-2022-34884

< 8.40-cdi394n

A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recove

7.2HIGH

CVE-2021-3519

< s04kt54a\/s04kt54p

A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS P

6.4MEDIUM

CVE-2020-8321

< 2020-09-01

A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and

6.4MEDIUM

CVE-2019-6190

< 2-27-2020

Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop

5.0MEDIUM

CVE-2019-0130

all versions

Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an un

7.4HIGH

CVE-2019-6156

all versions

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an

3.3LOW

CVE-2019-0135

all versions

Improper permissions in the installer for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allo

7.8HIGH