Lenovo Xclarity Administrator vulnerabilities, page 2
30 vulnerabilities
Known vulnerabilities in Lenovo Xclarity Administrator, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2019-6158lenovolenovo xclarity administrator+1
EPSS score1.47%
An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x.CVE-2019-6181lenovoxclarity_administrator+1EPSS score0.82%
A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow a crafted URL, if visited, to cause JavaScript code to be executed in the user's web browser. The JavaScript code is not executed on LXCA itself.CVE-2019-6194lenovoxclarity_administrator+1EPSS score0.74%
An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure.CVE-2019-6182lenovoxclarity_administrator+1EPSS score0.65%
A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an administrative user to store malformed data in LXCA Jobs and Event Log data, that could result in crafted formulas stored in an exported CSV file. The crafted formula is not executed on LXCA itself.CVE-2023-4605lenovoxclarity_administratorEPSS score0.46%
A valid authenticated Lenovo XClarity Administrator (LXCA) user can potentially leverage an unauthenticated API endpoint to retrieve system event information.CVE-2023-3113lenovolenovo xclarity administrator+1EPSS score0.50%
An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files.CVE-2023-34420lenovolenovo xclarity administrator+1EPSS score1.34%
A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API.CVE-2023-34418lenovolenovo xclarity administrator+1EPSS score0.55%
A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API.CVE-2023-34421lenovolenovo xclarity administrator+1EPSS score0.49%
A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation.CVE-2023-34422lenovolenovo xclarity administrator+1EPSS score0.49%
A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation.