Lenovo Xclarity Controller (Xcc)
Approved changes feed: RSS · Atom
cpe:2.3:a:lenovo:lenovo_xclarity_controller_(xcc):*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Lenovo (c98ed681-bc65-5c44-8bbb-e0a228f96d0e) |
|---|---|
| Product | Lenovo Xclarity Controller (Xcc) (e6221780-c053-5bb6-b0e9-ad05039d8d43) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-4608 |
vulnerable | 2026-06-08 06:16:13.774416 |
Details available
MEDIUM (4.1)
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.
This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
Published: 2023-10-24T20:25:49.416Z
Updated: 2024-09-11T20:38:29.704Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4607 |
vulnerable | 2026-06-08 06:16:13.649879 |
Details available
HIGH (7.5)
An authenticated XCC user can change permissions for any user through a crafted API command.
Published: 2023-10-24T20:25:30.100Z
Updated: 2024-12-03T14:39:50.517Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4606 |
vulnerable | 2026-06-08 06:16:13.552799 |
Details available
HIGH (8.1)
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.
This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
Published: 2023-10-24T20:25:09.243Z
Updated: 2024-09-11T18:24:50.644Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-6187 |
vulnerable | 2026-06-08 05:14:09.950913 |
Details available
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informational fields, that could result in crafted formulas being stored in an exported CSV file. The crafted formula is not executed on XCC itself and has no effect on the server.
Published: 2019-11-20T01:31:13.802Z
Updated: 2024-09-17T00:50:51.427Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.