Lenovo Xclarity Controller
11 CVEs affecting Lenovo Xclarity Controller. Latest disclosed: 2024-07-26. Critical: 0, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-0683 | High | 8.3 | 2023-05-01 | A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call. |
CVE-2023-29057 | High | 7.3 | 2023-04-28 | A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalat… |
CVE-2024-38512 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via… |
CVE-2024-38511 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privi… |
CVE-2024-38510 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privile… |
CVE-2024-38509 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a… |
CVE-2024-38508 | High | 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC us… |
CVE-2023-29058 | Medium | 6.4 | 2023-04-28 | A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CL… |
CVE-2023-25492 | Medium | 6.3 | 2023-05-01 | A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string inject… |
CVE-2023-29056 | Medium | 5.3 | 2023-04-28 | A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to u… |
CVE-2023-25495 | Medium | 4.9 | 2023-04-28 | A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an extern… |