CVE-2021-3956

CVE-2021-3956 concerns Lenovo XClarity Controller (XCC) firmware. Affected: third‑quarter 2021 XCC with LDAP Authentication Only Mode using LDAP servers that support unauthenticated binds (e.g., Active Directory). Vulnerability: unauthenticated user can gain read‑only access to the XCC configurat...

PT-2022-10923

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Controller XCC firmware affected versions not specified Description A read-only authentication bypass issue was reported in Lenovo XClarity Controller XCC firmware. This issue affects XCC devices configured in LDAP Authenticati...

Security Bulletin: Vulnerability identified in XCC affects IBM Cloud Pak System (CVE-2021-3473)

Summary Vulnerability identified in Lenovo XCC component bundled with IBM Cloud Pak System. Information about vulnerability has been published in a security advisiory. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

CVE-2021-3473

CVE-2021-3473 affects Lenovo XClarity Controller (XCC). An internal security audit found that during LXCA-assisted backup/restore, the XCC configuration backup/restore password may be written to an internal log buffer and briefly persist (typically

CVE-2021-3473

An internal product security audit of Lenovo XClarity Controller XCC discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator LXCA is used to perform the backup/restore. The backup/restore password typically exists...

PT-2021-20653

Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Controller XCC affected versions not specified Description: An internal product security audit discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity...

Authorization

An authorization bypass exists in Lenovo XClarity Controller XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1 “LDAP Authentication Only with Local...

CVE-2019-6195

Lenovo XClarity Controller (XCC) has an authorization bypass vulnerability (CVE-2019-6195) affecting XCC versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N. If configured with LDAP Authentication Only with Local Authorization and a lower-privileged user logs in within 1 minute of a higher...

CVE-2019-6187

CVE-2019-6187 describes a stored CSV injection in Lenovo XClarity Controller (XCC). The issue arises when a privileged user stores crafted data in XCC fields, leading to malicious formulas in exported CSVs. Public docs conflict on impact: NVD notes the formula is stored but not executed and has n...

PT-2019-18014

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Controller XCC affected versions not specified Description A stored CSV Injection issue was reported that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server...