Filtered by vendor Lenovo
Subscriptions
Filtered by product Xclarity Administrator
Subscriptions
Total
28 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-6158 | 1 Lenovo | 1 Xclarity Administrator | 2024-11-21 | N/A |
| An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x. | ||||
| CVE-2019-19757 | 1 Lenovo | 1 Xclarity Administrator | 2024-11-21 | 5.4 Medium |
| An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself. | ||||
| CVE-2019-19756 | 1 Lenovo | 1 Xclarity Administrator | 2024-11-21 | 7.9 High |
| An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are only accessible to authorized users in the First Failure Data Capture (FFDC) service log and log files on LXCA. | ||||
| CVE-2018-9066 | 1 Lenovo | 1 Xclarity Administrator | 2024-11-21 | N/A |
| In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged command execution within LXCA's underlying operating system. | ||||
| CVE-2018-9065 | 1 Lenovo | 1 Xclarity Administrator | 2024-11-21 | N/A |
| In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and potentially decrypt those credentials more easily than intended. | ||||
| CVE-2018-9064 | 1 Lenovo | 1 Xclarity Administrator | 2024-11-21 | N/A |
| In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user. | ||||
| CVE-2017-17833 | 5 Canonical, Debian, Lenovo and 2 more | 62 Ubuntu Linux, Debian Linux, Bm Nextscale Fan Power Controller and 59 more | 2024-11-21 | N/A |
| OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability. | ||||
| CVE-2024-45101 | 1 Lenovo | 1 Xclarity Administrator | 2024-09-14 | 6.8 Medium |
| A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click on a specially crafted URL. | ||||