CVE-2023-3113

CVE-2023-3113 (LXCA CIM server XXE) is an unauthenticated XML External Entity (XXE) vulnerability in Lenovo XClarity Administrator (LXCA) that could allow read-only access to specific files. Connected sources (NVD/Red Hat/CNNVD et al.) confirm the issue as an XXE affecting LXCA, with no publicly ...

CVE-2023-3113

An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files...

CVE-2023-3113

An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files...

PT-2023-24869 · Lenovo · Lxca

Name of the Vulnerable Software and Affected Versions: LXCA affected versions not specified Description: A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation...

PT-2023-23166 · Lenovo · Lxca

Name of the Vulnerable Software and Affected Versions: LXCA affected versions not specified Description: An unauthenticated XML external entity injection XXE vulnerability exists in LXCA's Common Information Model CIM server that could result in read-only access to specific files. Recommendations...

CVE-2021-3473

An internal product security audit of Lenovo XClarity Controller XCC discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator LXCA is used to perform the backup/restore. The backup/restore password typically exists...

CVE-2021-3473

CVE-2021-3473 affects Lenovo XClarity Controller (XCC). An internal security audit found that during LXCA-assisted backup/restore, the XCC configuration backup/restore password may be written to an internal log buffer and briefly persist (typically

Design/Logic Flaw

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator LXCA, if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in...

CVE-2021-3417

Lenovo XClarity Orchestrator (LXCO) prior to 1.2.2 stores LXCA credentials in internal logs: when LXCA is added as a Resource Manager, credentials are encoded and written to the FFDC/service log, which is only accessible to the privileged LXCO user who requested the file. No exploitation details ...

CVE-2020-8355

Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 exposes Windows OS credentials used for driver updates in the First Failure Data Capture (FFDC) service log if the log is generated during endpoint updates. The log is only created by a privileged LXCA user, access is limited to that use...

Lenovo XClarity Administrator (LXCA) Information Disclosure Vulnerability - Lenovo Support US

No description provided...

CVE-2019-19756

An internal product security audit of Lenovo XClarity Administrator LXCA discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are...

Design/Logic Flaw

An internal product security audit of Lenovo XClarity Administrator LXCA discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are...

CVE-2019-19756

CVE-2019-19756 affects Lenovo XClarity Administrator (LXCA) version 2.6.0 during Windows driver updates. A security audit found Windows OS credentials were written in plaintext to a log file, with access limited to authorized FFDC/service logs on LXCA. Documented impact is information disclosure ...

Lenovo XClarity Administrator (LXCA) Vulnerability - Lenovo Support US

No description provided...

Lenovo XClarity Administrator (LXCA) Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-29942 Potential Impact: Information disclosure Severity: High Scope of Impact: Lenovo-specific CVE Identifier: CVE-2019-19756 Summary Description: An internal product security audit of Lenovo XClarity Administrator LXCA discovered Windows OS credentials, used to...

Xxe

An XML External Entity XXE processing vulnerability was reported in Lenovo XClarity Administrator LXCA versions prior to 2.6.6 that could allow information disclosure...

CVE-2019-6194

CVE-2019-6194 is an XML External Entity (XXE) processing vulnerability in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could lead to information disclosure. Connected Lenovo advisories confirm the affected product (LXCA) and the fix: upgrade to LXCA 2.6.6 or later. The vulner...

CVE-2019-6193

CVE-2019-6193 affects Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6. It is an information-disclosure vulnerability that could allow unauthenticated access to configuration files containing usernames, license keys, IP addresses, and encrypted password hashes. Lenovo advisories recom...

CVE-2019-19757

Lenovo XClarity Administrator (LXCA) DOM-based cross-site scripting vulnerability exists in versions prior to 2.6.6. A specially crafted link could cause JavaScript to run in the user’s browser (executed on the user’s system, not LXCA). The advisory’s remediation is to upgrade to LXCA 2.6.6 or la...