CVSS: 8.3EPSS: 0%CPEs: 139EXPL: 0CVE-2024-8281
https://notcve.org/view.php?id=CVE-2024-8281
13 Sep 2024 — An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell. • https://support.lenovo.com/us/en/product_security/LEN-172051 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.3EPSS: 0%CPEs: 139EXPL: 0CVE-2024-8280
https://notcve.org/view.php?id=CVE-2024-8280
13 Sep 2024 — An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or cause a recoverable denial of service using a specially crafted file. • https://support.lenovo.com/us/en/product_security/LEN-172051 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.3EPSS: 0%CPEs: 139EXPL: 0CVE-2024-8279
https://notcve.org/view.php?id=CVE-2024-8279
13 Sep 2024 — A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads. • https://support.lenovo.com/us/en/product_security/LEN-172051 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.3EPSS: 0%CPEs: 139EXPL: 0CVE-2024-8278
https://notcve.org/view.php?id=CVE-2024-8278
13 Sep 2024 — A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands. • https://support.lenovo.com/us/en/product_security/LEN-172051 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.7EPSS: 0%CPEs: 225EXPL: 0CVE-2023-43577
https://notcve.org/view.php?id=CVE-2023-43577
08 Nov 2023 — A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. Se informó un desbordamiento del búfer en el módulo ReFlash en algunos productos de Lenovo Desktop que puede permitir que un atacante local con privilegios elevados ejecute código arbitrario. • https://support.lenovo.com/us/en/product_security/LEN-141775 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.7EPSS: 0%CPEs: 225EXPL: 0CVE-2023-43576
https://notcve.org/view.php?id=CVE-2023-43576
08 Nov 2023 — A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. Se informó un desbordamiento del búfer en el módulo WMISwSmi en algunos productos de Lenovo Desktop que puede permitir que un atacante local con privilegios elevados ejecute código arbitrario. • https://support.lenovo.com/us/en/product_security/LEN-141775 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 6.7EPSS: 0%CPEs: 225EXPL: 0CVE-2023-43575
https://notcve.org/view.php?id=CVE-2023-43575
08 Nov 2023 — A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. Se informó un desbordamiento del búfer en el módulo UltraFunctionTable en algunos productos de Lenovo Desktop que puede permitir que un atacante local con privilegios elevados ejecute código arbitrario. • https://support.lenovo.com/us/en/product_security/LEN-141775 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 4.4EPSS: 0%CPEs: 225EXPL: 0CVE-2023-43574
https://notcve.org/view.php?id=CVE-2023-43574
08 Nov 2023 — A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information. Se informó una lectura excesiva del búfer en el módulo LEMALLDriversConnectedEventHook en algunos productos de Lenovo Desktop que puede permitir que un atacante local con privilegios elevados revele información sensible. • https://support.lenovo.com/us/en/product_security/LEN-141775 • CWE-125: Out-of-bounds Read CWE-126: Buffer Over-read •
CVSS: 6.7EPSS: 0%CPEs: 225EXPL: 0CVE-2023-43573
https://notcve.org/view.php?id=CVE-2023-43573
08 Nov 2023 — A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. Se informó un desbordamiento del búfer en el módulo LEMALLDriversConnectedEventHook en algunos productos de Lenovo Desktop que puede permitir que un atacante local con privilegios elevados ejecute código arbitrario. • https://support.lenovo.com/us/en/product_security/LEN-141775 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 4.4EPSS: 0%CPEs: 225EXPL: 0CVE-2023-43572
https://notcve.org/view.php?id=CVE-2023-43572
08 Nov 2023 — A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information. Se informó una lectura excesiva del búfer en el módulo BiosExtensionLoader en algunos productos de Lenovo Desktop que puede permitir que un atacante local con privilegios elevados revele información sensible. • https://support.lenovo.com/us/en/product_security/LEN-141775 • CWE-125: Out-of-bounds Read CWE-126: Buffer Over-read •