Thinksystem Sr670 V2 Firmware (Lenovo) - vulnerabilities (CVEs)

23 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2024-09-13. Vendor: Lenovo.

CVEs of Thinksystem Sr670 V2 Firmware

CVE-2024-8281 - CVSS 7.2 (high), 2024-09-13: An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection…
CVE-2024-8280 - CVSS 7.2 (high), 2024-09-13: An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or…
CVE-2024-8278 - CVSS 7.2 (high), 2024-09-13: A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command…
CVE-2024-8279 - CVSS 7.2 (high), 2024-09-13: A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command…
CVE-2024-45105 - CVSS 6.7 (medium), 2024-09-13: An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local…
CVE-2024-38511 - CVSS 7.2 (high), 2024-07-26: A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated…
CVE-2024-38510 - CVSS 7.2 (high), 2024-07-26: A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated…
CVE-2024-38512 - CVSS 7.2 (high), 2024-07-26: A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection…
CVE-2024-38508 - CVSS 7.2 (high), 2024-07-26: A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC…
CVE-2024-38509 - CVSS 7.2 (high), 2024-07-26: A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a…
CVE-2024-23591 - CVSS 2.3 (low), 2024-02-16: ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an attacker with…
CVE-2023-4607 - CVSS 8.8 (high), 2023-10-25: An authenticated XCC user can change permissions for any user through a crafted API command.
CVE-2023-4606 - CVSS 8.1 (high), 2023-10-25: An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3…
CVE-2023-4608 - CVSS 7.2 (high), 2023-10-25: An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem…
CVE-2023-25492 - CVSS 8.8 (high), 2023-05-01: A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string…
CVE-2023-0683 - CVSS 8.8 (high), 2023-05-01: A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.
CVE-2023-29056 - CVSS 5.9 (medium), 2023-04-28: A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to…
CVE-2023-25495 - CVSS 4.9 (medium), 2023-04-28: A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an…
CVE-2023-29057 - CVSS 8.8 (high), 2023-04-28: A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege…
CVE-2023-29058 - CVSS 6.5 (medium), 2023-04-28: A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC…
CVE-2022-40134 - CVSS 4.4 (medium), 2023-01-30: An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated…
CVE-2022-34884 - CVSS 7.2 (high), 2023-01-30: A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of…
CVE-2022-34888 - CVSS 4.3 (medium), 2023-01-30: The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible…