Thinkagile Hx Enclosure Certified Node Firmware vulnerabilities
6 known vulnerabilities in Thinkagile Hx Enclosure Certified Node Firmware from Lenovo. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
XClarity Controller: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.
- 7.2 High severity
XClarity Controller: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.
- 7.2 High severity
XClarity Controller: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.
- 7.2 High severity
XClarity Controller: Stack-based Buffer Overflow
A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.
- 7.2 High severity
XClarity Controller: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request.
- 7.5 High severity
System Management Module (SMM): Asymmetric Resource Consumption (Amplification)
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.