Lenovo Xclarity_administrator
27 CVEs affecting Lenovo Xclarity_administrator. Latest disclosed: 2024-09-13. Critical: 2, High: 13.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-17833 | Critical | 9.8 | 2018-04-23 | OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote c… |
CVE-2016-8233 | Critical | 9.8 | 2017-03-01 | Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that coul… |
CVE-2018-9066 | High | 8.8 | 2018-07-30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a… |
CVE-2018-9064 | High | 8.8 | 2018-07-30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the Sys… |
CVE-2017-3770 | High | 8.8 | 2017-09-22 | Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interface functionality to… |
CVE-2019-6158 | High | 8.7 | 2019-05-03 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This on… |
CVE-2023-3113 | High | 8.2 | 2023-06-26 | An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only acce… |
CVE-2023-34418 | High | 8.1 | 2023-06-26 | A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a spec… |
CVE-2019-19756 | High | 7.9 | 2020-03-13 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems… |
CVE-2017-3745 | High | 7.8 | 2017-06-20 | In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password informatio… |
CVE-2019-6193 | High | 7.5 | 2020-02-14 | An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to… |
CVE-2019-6179 | High | 7.5 | 2019-09-03 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator… |
CVE-2018-9065 | High | 7.5 | 2018-07-30 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a c… |
CVE-2023-34420 | High | 7.2 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. |
CVE-2016-8221 | High | 7.0 | 2017-01-12 | Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules… |
CVE-2017-3763 | Medium | 6.7 | 2017-09-22 | An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts in LXCA versions e… |
CVE-2023-34422 | Medium | 6.5 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due… |
CVE-2023-34421 | Medium | 6.5 | 2023-06-26 | A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficien… |
CVE-2024-45104 | Medium | 6.3 | 2024-09-13 | A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially cr… |
CVE-2019-6181 | Medium | 6.1 | 2019-09-03 | A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow a crafted UR… |