CVSS: 7.8EPSS: 84%CPEs: 3EXPL: 4CVE-2022-3699 – Lenovo Diagnostics Driver Memory Access
https://notcve.org/view.php?id=CVE-2022-3699
03 Feb 2023 — A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 that could allow a local user to execute code with elevated privileges. Se informó una vulnerabilidad de escalada de privilegios en Lenovo HardwareScanPlugin antes de la versión 1.3.1.2 y Lenovo Diagnostics antes de la versión 4.45 que podría permitir a un usuario local ejecutar código con privilegios elevados. A privilege escalation vulnerability was repor... • https://packetstorm.news/files/id/170849 • CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 196EXPL: 0CVE-2022-34888
https://notcve.org/view.php?id=CVE-2022-34888
30 Jan 2023 — The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users. Internal service access controls, as applicable, remain in effect. • https://support.lenovo.com/us/en/product_security/LEN-87734 • CWE-184: Incomplete List of Disallowed Inputs CWE-697: Incorrect Comparison •
CVSS: 7.2EPSS: 0%CPEs: 196EXPL: 0CVE-2022-34884
https://notcve.org/view.php?id=CVE-2022-34884
30 Jan 2023 — A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of service. • https://support.lenovo.com/us/en/product_security/LEN-87734 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.7EPSS: 0%CPEs: 598EXPL: 0CVE-2022-40137
https://notcve.org/view.php?id=CVE-2022-40137
30 Jan 2023 — A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code. • https://support.lenovo.com/us/en/product_security/LEN-94953 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 4.4EPSS: 0%CPEs: 300EXPL: 0CVE-2022-40136
https://notcve.org/view.php?id=CVE-2022-40136
30 Jan 2023 — An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. • https://support.lenovo.com/us/en/product_security/LEN-94953 • CWE-125: Out-of-bounds Read •
CVSS: 4.4EPSS: 0%CPEs: 278EXPL: 0CVE-2022-40135
https://notcve.org/view.php?id=CVE-2022-40135
30 Jan 2023 — An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. • https://support.lenovo.com/us/en/product_security/LEN-94953 • CWE-125: Out-of-bounds Read •
CVSS: 4.4EPSS: 0%CPEs: 673EXPL: 0CVE-2022-40134
https://notcve.org/view.php?id=CVE-2022-40134
30 Jan 2023 — An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. • https://support.lenovo.com/us/en/product_security/LEN-94953 • CWE-125: Out-of-bounds Read •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2022-4816
https://notcve.org/view.php?id=CVE-2022-4816
23 Jan 2023 — A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application. Se identificó una vulnerabilidad de denegación de servicio en Lenovo Safecenter que podría permitir que un usuario local bloquee la aplicación. • https://iknow.lenovo.com.cn/detail/dc_205899.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.7EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3432
https://notcve.org/view.php?id=CVE-2022-3432
23 Jan 2023 — A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. Una vulnerabilidad potencial en un controlador utilizado durante el proceso de fabricación en el Ideapad Y700-14ISK que no se desactivó por error puede permitir que un atacante con privilegios elevados modifique la configuración de arranque seguro modificando una varia... • https://support.lenovo.com/us/en/product_security/LEN-94952 • CWE-276: Incorrect Default Permissions •
CVSS: 6.7EPSS: 0%CPEs: 88EXPL: 0CVE-2022-3430
https://notcve.org/view.php?id=CVE-2022-3430
23 Jan 2023 — A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. Una vulnerabilidad potencial en el controlador de configuración WMI en algunos dispositivos portátiles Lenovo Notebook puede permitir que un atacante con privilegios elevados modifique la configuración de arranque seguro modificando una variable NVRAM. • https://support.lenovo.com/us/en/product_security/LEN-94952 • CWE-276: Incorrect Default Permissions •