CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2020-8355
https://notcve.org/view.php?id=CVE-2020-8355
10 Feb 2021 — An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials provided by the LXCA user to perform driver updates of managed systems may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated while managed endpoints are updating. The service log is only generated when requested by a privileged LXCA user and it is only accessible to the privileged LXCA user that requested the file and is then d... • https://support.lenovo.com/us/en/product_security/LEN-50446 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 7.9EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19756
https://notcve.org/view.php?id=CVE-2019-19756
13 Mar 2020 — An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are only accessible to authorized users in the First Failure Data Capture (FFDC) service log and log files on LXCA. Una auditoría interna de seguridad del producto de Lenovo XClarity Administrator (LXCA), detectó que... • https://support.lenovo.com/us/en/product_security/LEN-29942 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2019-6194
https://notcve.org/view.php?id=CVE-2019-6194
14 Feb 2020 — An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure. Se reportó una vulnerabilidad de procesamiento de XML External Entity (XXE) en Lenovo XClarity Administrator (LXCA) versiones anteriores a 2.6.6, lo que podría permitir una divulgación de información. • https://support.lenovo.com/us/en/product_security/LEN-29477 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-6193
https://notcve.org/view.php?id=CVE-2019-6193
14 Feb 2020 — An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames, license keys, IP addresses, and encrypted password hashes. Se reportó una vulnerabilidad de divulgación de información en Lenovo XClarity Administrator (LXCA) versiones anteriores a 2.6.6, lo que podría permitir el acceso no autenticado a algunos archivos de configuración que pueden contener nombr... • https://support.lenovo.com/us/en/product_security/LEN-29477 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19757
https://notcve.org/view.php?id=CVE-2019-19757
14 Feb 2020 — An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself. Una auditoría interna de seguridad del producto Lenovo XClarity Administrator (LXCA) detectó una vulnerabilidad de tipo cross-site ... • https://support.lenovo.com/us/en/product_security/LEN-29477 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •