CVSS: 6.7EPSS: 0%CPEs: 40EXPL: 0CVE-2023-5078
https://notcve.org/view.php?id=CVE-2023-5078
08 Nov 2023 — A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware. Se informó una vulnerabilidad en algunos BIOS de ThinkPad que podría permitir que un atacante físico o local con privilegios elevados altere el firmware del BIOS. • https://support.lenovo.com/us/en/product_security/LEN-141775 • CWE-665: Improper Initialization CWE-1419: Incorrect Initialization of Resource •
CVSS: 6.7EPSS: 0%CPEs: 202EXPL: 0CVE-2022-48189
https://notcve.org/view.php?id=CVE-2022-48189
30 Oct 2023 — An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code. Una vulnerabilidad de validación de entrada del controlador SMM en el BIOS de algunos modelos ThinkPad podría permitir que un atacante con acceso local y privilegios elevados ejecute código arbitrario. • https://support.lenovo.com/us/en/product_security/LEN-106014 • CWE-20: Improper Input Validation •
CVSS: 6.7EPSS: 0%CPEs: 52EXPL: 0CVE-2023-4029
https://notcve.org/view.php?id=CVE-2023-4029
17 Aug 2023 — A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code. Se ha identificado un desbordamiento de búfer en el controlador BoardUpdateAcpiDxe de algunos productos ThinkPad de Lenovo que puede permitir a un atacante con acceso local y privilegios elevados ejecutar código arbitrario. • https://support.lenovo.com/us/en/product_security/LEN-134879 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.7EPSS: 0%CPEs: 226EXPL: 0CVE-2023-2290
https://notcve.org/view.php?id=CVE-2023-2290
26 Jun 2023 — A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to execute arbitrary code. • https://support.lenovo.com/us/en/product_security/LEN-106014 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 4.4EPSS: 0%CPEs: 673EXPL: 0CVE-2022-40134
https://notcve.org/view.php?id=CVE-2022-40134
30 Jan 2023 — An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. • https://support.lenovo.com/us/en/product_security/LEN-94953 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 272EXPL: 0CVE-2021-3786
https://notcve.org/view.php?id=CVE-2021-3786
12 Nov 2021 — A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range. Una vulnerabilidad potencial en la función SMI callback usada en la configuración de CSME de algunos sistemas Lenovo Notebook y ThinkPad podría ser usada para filtrar datos fuera del rango de la SMRAM • https://support.lenovo.com/us/en/product_security/LEN-67440 • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 0%CPEs: 272EXPL: 0CVE-2021-3599
https://notcve.org/view.php?id=CVE-2021-3599
12 Nov 2021 — A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code. Una posible vulnerabilidad en la función SMI callback usada para acceder al dispositivo flash en algunos modelos de ThinkPad puede permitir a un atacante con acceso local y privilegios elevados ejecutar código arbitrario • https://support.lenovo.com/us/en/product_security/LEN-67440 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 125EXPL: 0CVE-2021-3462
https://notcve.org/view.php?id=CVE-2021-3462
13 Apr 2021 — A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the driver's device object. Una vulnerabilidad de escalada de privilegios en Lenovo Power Management Driver para Windows 10, anteriores a versión 1.67.17.54, que podría permitir el acceso no autorizado al objeto del dispositivo del controlador • https://support.lenovo.com/us/en/product_security/LEN-59174 • CWE-276: Incorrect Default Permissions •
CVSS: 4.9EPSS: 0%CPEs: 125EXPL: 0CVE-2021-3463
https://notcve.org/view.php?id=CVE-2021-3463
13 Apr 2021 — A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause systems to experience a blue screen error. Una vulnerabilidad de desreferencia de puntero null en Lenovo Power Management Driver para Windows 10, anteriores a versión 1.67.17.54, que podría causar que los sistemas experimenten un error de pantalla azul • https://support.lenovo.com/us/en/product_security/LEN-59174 • CWE-476: NULL Pointer Dereference •
CVSS: 4.4EPSS: 0%CPEs: 81EXPL: 3CVE-2019-6192 – Lenovo Power Management Driver 1.67.17.48 - 'pmdrvs.sys' Denial of Service (PoC)
https://notcve.org/view.php?id=CVE-2019-6192
10 Dec 2019 — A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 leading to a buffer overflow which could cause a denial of service. Ha sido reportada una posible vulnerabilidad en Lenovo Power Management Driver versiones anteriores a la versión 1.67.17.48, conllevando un desbordamiento de búfer que podría causar una denegación de servicio. Lenovo Power Management Driver suffers from buffer overflow vulnerability. • https://packetstorm.news/files/id/155656 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •