Lenovo
Lenovo Xclarity Administrator: vulnerabilidades y CVE
Lenovo Xclarity Administrator tiene 28 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE28
Últimos 12 meses0
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2024-45104 | Media (6.5) | 0.20% | — | 13 sept 2024 | A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call. |
| CVE-2024-45103 | Media (4.3) | 0.34% | — | 13 sept 2024 | A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges. |
| CVE-2023-4605 | Media (6.5) | 0.46% | — | 5 abr 2024 | A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information. |
| CVE-2023-3113 | Alta (7.5) | 0.50% | — | 26 jun 2023 | An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files. |
| CVE-2023-34422 | Media (6.5) | 0.49% | — | 26 jun 2023 | A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation. |
| CVE-2023-34421 | Media (6.5) | 0.49% | — | 26 jun 2023 | A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation. |
| CVE-2023-34420 | Alta (7.2) | 1.3% | — | 26 jun 2023 | A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. |
| CVE-2023-34418 | Alta (8.1) | 0.55% | — | 26 jun 2023 | A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API. |
| CVE-2020-8355 | Media (4.9) | 0.53% | — | 10 feb 2021 | An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be… |
| CVE-2019-19756 | Media (6) | 0.31% | — | 13 mar 2020 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only… |
| CVE-2019-6194 | Media (5.5) | 0.74% | — | 14 feb 2020 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure. |
| CVE-2019-6193 | Alta (7.5) | 1.0% | — | 14 feb 2020 | An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames,… |
| CVE-2019-19757 | Media (5.4) | 0.52% | — | 14 feb 2020 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to… |
| CVE-2019-6182 | Media (4.9) | 0.65% | — | 3 sept 2019 | A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to store malformed data in LXCA Jobs and Event Log data, that… |
| CVE-2019-6181 | Media (6.1) | 0.82% | — | 3 sept 2019 | A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow a crafted URL, if visited, to cause JavaScript code to be executed in… |
| CVE-2019-6180 | Media (4.8) | 0.65% | — | 3 sept 2019 | A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to cause JavaScript code to be stored in LXCA which… |
| CVE-2019-6179 | Alta (7.5) | 1.4% | — | 3 sept 2019 | An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XClarity Integrator (LXCI) for Microsoft System Center prior to version 7.7.0,… |
| CVE-2019-6158 | Media (5.9) | 1.5% | — | 3 may 2019 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been… |
| CVE-2018-9066 | Alta (8.8) | 2.2% | — | 30 jul 2018 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged… |
| CVE-2018-9065 | Alta (7.5) | 0.46% | — | 30 jul 2018 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names… |
| CVE-2018-9064 | Alta (8.8) | 0.96% | — | 30 jul 2018 | In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user. |
| CVE-2017-17833 | Crítica (9.8) | 3.8% | — | 23 abr 2018 | OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability. |
| CVE-2017-3764 | Media (5.3) | 0.89% | — | 30 nov 2017 | A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password… |
| CVE-2017-3770 | Alta (8.8) | 1.0% | — | 22 sept 2017 | Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interface functionality to execute privileged commands within the underlying LXCA… |
| CVE-2017-3763 | Media (6.7) | 0.32% | — | 22 sept 2017 | An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts in LXCA versions earlier than 1.3.2. |
| CVE-2017-3745 | Alta (7.8) | 0.40% | — | 20 jun 2017 | In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's… |
| CVE-2016-8233 | Crítica (9.8) | 1.1% | — | 1 mar 2017 | Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that could be viewed by a non-privileged user. |
| CVE-2016-8221 | Alta (7) | 0.30% | — | 12 ene 2017 | Privilege Escalation in Lenovo XClarity Administrator earlier than 1.2.0, if LXCA is used to manage rack switches or chassis with embedded input/output modules (IOMs), certain log files viewable by authenticated users… |
Otros productos de Lenovo
Thinkcentre M625q Firmware · 28Ideacentre Gaming 5-14iob6 Firmware · 27V50t-13imb Firmware · 27Ideacentre 5-14iob6 Firmware · 27Thinkcentre M75n Firmware · 27Ideacentre G5-14imb05 Firmware · 27Thinkcentre M75t GEN 2 Firmware · 26V30a-22iml Firmware · 26Ideacentre 3-07imb05 Firmware · 26Ideacentre C5-14imb05 Firmware · 26Ideacentre Creator 5-14iob6 Firmware · 26Thinkcentre M75s GEN 2 Firmware · 26