CVE-2024-8280

CVE-2024-8280 describes an input validation weakness in Lenovo’s XClarity Controller (XCC) that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or cause a recoverable denial of service by processing a specially crafted file. The vulnerability is t...

CVE-2024-4550

CVE-2024-4550 describes a potential buffer overflow in Lenovo ThinkSystem and ThinkStation products. Based on connected sources, the vulnerability could allow a local attacker with elevated privileges to execute arbitrary code. Details on affected models, exact root cause, and available fixes/rem...

CVE-2024-4550

A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attacker with elevated privileges to execute arbitrary code...

CVE-2024-4550

A potential buffer overflow vulnerability was reported in some Lenovo ThinkSystem and ThinkStation products that could allow a local attacker with elevated privileges to execute arbitrary code...

CVE-2024-3100

A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute arbitrary code...

Vulnerabilities fixed in Solarwinds Access Rights Manager

Solarwinds has fixed vulnerabilities in Access Rights Manager. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges and execute arbitrary code with application privileges. Solarwinds has released updates to fix the vulnerabilities. See attached references f...

Lenovo Notebook security vulnerabilities

Lenovo Notebook is a laptop computer from Lenovo, a Chinese company. A security vulnerability exists in Lenovo Notebook that stems from a potential buffer overflow issue that could allow a local attacker with elevated privileges to execute arbitrary code...

CVE-2024-3100: Stack-based Buffer Overflow

A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute arbitrary code...

Lenovo ThinkSystem security vulnerabilities

Lenovo ThinkSystem is a ThinkSystem series server appliance from Lenovo, a Chinese company. A security vulnerability exists in the Lenovo ThinkSystem that stems from a UEFI system management mode vulnerability contained in the ThinkSystem that could allow a local attacker with elevated privileges...

CVE-2024-8280: Improper Neutralization of Special Elements used in an OS Command

An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or cause a recoverable denial of service using a specially crafted file...

Lenovo XClarity Controller security vulnerabilities

Lenovo XClarity Controller Lenovo XCC is a server embedded management engine from Lenovo China. It is primarily used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller, which stems from a vulnerability that could allow a valid...

Lenovo XClarity Controller security vulnerabilities

Lenovo XClarity Controller Lenovo XCC is a server embedded management engine from Lenovo China. It is primarily used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller, which stems from a vulnerability that could allow a validl...

Lenovo XClarity Controller security vulnerabilities

Lenovo XClarity Controller Lenovo XCC is a server embedded management engine from Lenovo China. It is primarily used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller, which stems from a specially constructed file upload that...

Lenovo XClarity Controller security vulnerabilities

Lenovo XClarity Controller Lenovo XCC is a server embedded management engine from Lenovo China. It is primarily used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller, which stems from a command injection via specially...

PT-2024-38911 · Xcc · Xcc

Name of the Vulnerable Software and Affected Versions: XCC affected versions not specified Description: An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line...

CVE-2024-8281: Improper Neutralization of Special Elements used in an OS Command

An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell...

Security Updates for Microsoft Office Online Server (September 2024)

The Microsoft Office Web Apps installation on the remote host is missing a security update. It is, therefore, affected by the following: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2024-43465 Note that Nessus has not tested for this iss...

CVE-2024-20430

A vulnerability in Cisco Meraki Systems Manager SM Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with elevated privileges. This vulnerability is due to incorrect handling of directory search paths at runtime. A low-privileged attacker could exploit this...

CVE-2024-20430 Cisco Meraki Systems Manager Agent for Windows Privilege Escalation Vulnerability

A vulnerability in Cisco Meraki Systems Manager SM Agent for Windows could allow an authenticated, local attacker to execute arbitrary code with elevated privileges. This vulnerability is due to incorrect handling of directory search paths at runtime. A low-privileged attacker could exploit this...

CVE-2024-20430

CVE-2024-20430 affects Cisco Meraki Systems Manager (SM) Agent for Windows. The issue stems from incorrect handling of directory search paths at runtime, enabling an authenticated, local attacker to read and place malicious configuration files and DLLs that are executed when SM launches at startu...