Vulnerabilities > Lenovo > Xclarity Administrator > 3.1.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-13 | CVE-2024-45103 | Unspecified vulnerability in Lenovo Xclarity Administrator A valid, authenticated LXCA user may be able to unmanage an LXCA managed device in through the LXCA web interface without sufficient privileges. | 4.3 |
| 2024-09-13 | CVE-2024-45104 | Unspecified vulnerability in Lenovo Xclarity Administrator A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call. | 6.5 |
| 2023-06-26 | CVE-2023-34418 | SQL Injection vulnerability in Lenovo Xclarity Administrator A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability in a specific web API. | 8.1 |
| 2023-06-26 | CVE-2023-34420 | OS Command Injection vulnerability in Lenovo Xclarity Administrator A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted calls to a specific web API. | 7.2 |
| 2023-06-26 | CVE-2023-34421 | Improper Input Validation vulnerability in Lenovo Xclarity Administrator A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically crafted web API call due to insufficient input validation. | 6.5 |
| 2023-06-26 | CVE-2023-34422 | Improper Input Validation vulnerability in Lenovo Xclarity Administrator A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through a specifically crafted web API call due to insufficient input validation. | 6.5 |
| 2023-06-26 | CVE-2023-3113 | XXE vulnerability in Lenovo Xclarity Administrator An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files. | 7.5 |