Lenovo

Thinkagile Hx5530 Firmware

17 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.7

CVE-2024-45105

  • EPSS 0.04%
  • Veröffentlicht 13.09.2024 18:15:05
  • Zuletzt bearbeitet 14.09.2024 11:47:14

An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code.

7.2

CVE-2024-38512

  • EPSS 0.37%
  • Veröffentlicht 26.07.2024 20:15:04
  • Zuletzt bearbeitet 21.11.2024 09:26:07

A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.

7.2

CVE-2024-38511

  • EPSS 0.35%
  • Veröffentlicht 26.07.2024 20:15:04
  • Zuletzt bearbeitet 21.11.2024 09:26:07

A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.

7.2

CVE-2024-38510

  • EPSS 0.37%
  • Veröffentlicht 26.07.2024 20:15:04
  • Zuletzt bearbeitet 21.11.2024 09:26:07

A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.

7.2

CVE-2024-38509

  • EPSS 0.29%
  • Veröffentlicht 26.07.2024 20:15:03
  • Zuletzt bearbeitet 21.11.2024 09:26:07

A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.

7.2

CVE-2024-38508

  • EPSS 0.37%
  • Veröffentlicht 26.07.2024 20:15:03
  • Zuletzt bearbeitet 21.11.2024 09:26:07

A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request.

8.1

CVE-2023-4606

  • EPSS 0.12%
  • Veröffentlicht 25.10.2023 18:17:41
  • Zuletzt bearbeitet 21.11.2024 08:35:31

An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.   This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

7.2

CVE-2023-4608

  • EPSS 0.1%
  • Veröffentlicht 25.10.2023 18:17:41
  • Zuletzt bearbeitet 21.11.2024 08:35:32

An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

8.8

CVE-2023-4607

  • EPSS 0.13%
  • Veröffentlicht 25.10.2023 18:17:41
  • Zuletzt bearbeitet 21.11.2024 08:35:32

An authenticated XCC user can change permissions for any user through a crafted API command.

8.8

CVE-2023-25492

  • EPSS 0.15%
  • Veröffentlicht 01.05.2023 15:15:09
  • Zuletzt bearbeitet 21.11.2024 07:49:36

A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API.