Thinkagile Vx3331 Firmware vulnerabilities
10 known vulnerabilities in Thinkagile Vx3331 Firmware from Lenovo. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
XClarity Controller: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.
- 7.2 High severity
XClarity Controller: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.
- 7.2 High severity
XClarity Controller: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.
- 7.2 High severity
XClarity Controller: Stack-based Buffer Overflow
A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.
- 7.2 High severity
XClarity Controller: Improper Neutralization of Special Elements used in an OS Command
A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request.
- 7.2 High severity
SMM, SMM2, FPC: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system commands when performing a specific administrative function.
- 7.2 High severity
Lenovo XClarity Controller (XCC): Improper Neutralization of Special Elements used in an SQL Command
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
- 8.1 High severity
Lenovo XClarity Controller (XCC): Missing Authorization
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
- 8.8 High severity
XClarity Controller: Use of Externally-Controlled Format String
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API.
- 8.8 High severity
XClarity Controller: Incorrect Default Permissions
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured