Thinkagile Hx Enclosure Firmware (Lenovo) - vulnerabilities (CVEs)
9 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2024-04-15. Vendor: Lenovo.
CVEs of Thinkagile Hx Enclosure Firmware
- CVE-2024-2659 - CVSS 7.2 (high), 2024-04-15: A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system…
- CVE-2023-4607 - CVSS 8.8 (high), 2023-10-25: An authenticated XCC user can change permissions for any user through a crafted API command.
- CVE-2023-2992 - CVSS 7.5 (high), 2023-06-26: An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted…
- CVE-2023-25492 - CVSS 8.8 (high), 2023-05-01: A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string…
- CVE-2023-0683 - CVSS 8.8 (high), 2023-05-01: A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.
- CVE-2023-29056 - CVSS 5.9 (medium), 2023-04-28: A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to…
- CVE-2023-25495 - CVSS 4.9 (medium), 2023-04-28: A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an…
- CVE-2023-29058 - CVSS 6.5 (medium), 2023-04-28: A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC…
- CVE-2023-29057 - CVSS 8.8 (high), 2023-04-28: A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege…
