Thinkstation P920 Firmware (Lenovo) - vulnerabilities (CVEs)

15 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2023-05-01. Vendor: Lenovo.

CVEs of Thinkstation P920 Firmware

CVE-2023-25492 - CVSS 8.8 (high), 2023-05-01: A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string…
CVE-2023-0683 - CVSS 8.8 (high), 2023-05-01: A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.
CVE-2023-29056 - CVSS 5.9 (medium), 2023-04-28: A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to…
CVE-2023-25495 - CVSS 4.9 (medium), 2023-04-28: A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an…
CVE-2023-29057 - CVSS 8.8 (high), 2023-04-28: A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege…
CVE-2023-29058 - CVSS 6.5 (medium), 2023-04-28: A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC…
CVE-2022-40136 - CVSS 4.4 (medium), 2023-01-30: An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access…
CVE-2022-34884 - CVSS 7.2 (high), 2023-01-30: A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of…
CVE-2022-34888 - CVSS 4.3 (medium), 2023-01-30: The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible…
CVE-2021-3519 - CVSS 6.8 (medium), 2021-11-12: A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List"…
CVE-2020-8321 - CVSS 6.7 (medium), 2020-06-09: A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may…
CVE-2019-6190 - CVSS 5.5 (medium), 2020-02-14: Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and…
CVE-2019-0130 - CVSS 7.4 (high), 2019-06-13: Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an unauthenticated user to…
CVE-2019-6156 - CVSS 3.3 (low), 2019-04-10: In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of…
CVE-2019-0135 - CVSS 7.8 (high), 2019-03-14: Improper permissions in the installer for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an authenticated user to…