CVE-2020-8356

An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture FFDC service log. The FFDC...

Design/Logic Flaw

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator LXCA, if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in...

Design/Logic Flaw

An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture FFDC service log. The FFDC...

CVE-2021-3417

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator LXCA, if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in...

CVE-2021-3417

Lenovo XClarity Orchestrator (LXCO) prior to 1.2.2 stores LXCA credentials in internal logs: when LXCA is added as a Resource Manager, credentials are encoded and written to the FFDC/service log, which is only accessible to the privileged LXCO user who requested the file. No exploitation details ...

CVE-2020-8356

An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture FFDC service log. The FFDC...

PT-2021-12731

Name of the Vulnerable Software and Affected Versions: LXCO versions prior to 1.2.2 Description: An internal product security audit discovered that optional passwords for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. The affected logs are captured in the...

PT-2021-20390

Name of the Vulnerable Software and Affected Versions: LXCO versions prior to 1.2.2 Description: An internal product security audit discovered that credentials for Lenovo XClarity Administrator LXCA, if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a...

CVE-2021-3417: Cleartext Transmission of Sensitive Information

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator LXCA, if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in...

CVE-2020-8355

An internal product security audit of Lenovo XClarity Administrator LXCA prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Failure Data Capture FFDC service log if the service log is...

CVE-2020-8355

An internal product security audit of Lenovo XClarity Administrator LXCA prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Failure Data Capture FFDC service log if the service log is...

CVE-2020-8355

Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 exposes Windows OS credentials used for driver updates in the First Failure Data Capture (FFDC) service log if the log is generated during endpoint updates. The log is only created by a privileged LXCA user, access is limited to that use...

PT-2021-12730

Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Administrator versions prior to 3.1.0 Description: An issue was discovered where Windows OS credentials provided for driver updates may be captured in the First Failure Data Capture FFDC service log if it is generated during...

CVE-2020-8355: Cleartext Transmission of Sensitive Information

An internal product security audit of Lenovo XClarity Administrator LXCA prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Failure Data Capture FFDC service log if the service log is...

Design/Logic Flaw

An internal product security audit of Lenovo XClarity Administrator LXCA discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are...

PT-2020-10230

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Administrator version 2.6.0 Description An internal product security audit discovered that Windows OS credentials used for driver updates of managed systems are being written to a log file in clear text. This issue affects the...

CVE-2019-6157

In various firmware versions of Lenovo System x, the integrated management module II IMM2's first failure data capture FFDC includes the web server's private key in the generated log file for support...

CVE-2019-6157

CVE-2019-6157 affects Lenovo System x IMM2: FFDC logs may include the web server private key, enabling information disclosure. Affected product lines include IMM2 in System x & BladeCenter; root cause is improper handling of private key data in FFDC logs. IBM IBM X-Force/IBM bulletin and Lenovo L...

CVE-2019-6157: Insertion of Sensitive Information into Log File

In various firmware versions of Lenovo System x, the integrated management module II IMM2's first failure data capture FFDC includes the web server's private key in the generated log file for support...

PT-2019-17990

Name of the Vulnerable Software and Affected Versions Lenovo System x affected versions not specified Description The issue concerns the integrated management module II IMM2's first failure data capture FFDC in various firmware versions of Lenovo System x. The FFDC includes the web server's priva...