Thinksystem Sr950 Firmware
Approved changes feed: RSS · Atom
cpe:2.3:o:lenovo:thinksystem_sr950_firmware:*:*:*:*:*:*:*:*
part: o version: * update: *
| Vendor | Lenovo (c98ed681-bc65-5c44-8bbb-e0a228f96d0e) |
|---|---|
| Product | Thinksystem Sr950 Firmware (c5766ee7-f770-51a1-9b4c-6fe09ac835b5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-29058 |
vulnerable | 2026-06-08 06:02:38.438372 |
Details available
MEDIUM (6.4)
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.
Published: 2023-04-28T20:47:46.172Z
Updated: 2025-01-30T18:49:28.930Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29057 |
vulnerable | 2026-06-08 06:02:38.411952 |
Details available
HIGH (7.3)
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.
Published: 2023-04-28T20:53:13.267Z
Updated: 2025-01-30T18:34:12.946Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29056 |
vulnerable | 2026-06-08 06:02:38.374012 |
Details available
MEDIUM (5.3)
A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.
Published: 2023-04-28T21:07:40.439Z
Updated: 2025-01-30T18:26:37.319Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25495 |
vulnerable | 2026-06-08 05:56:09.062016 |
Details available
MEDIUM (4.9)
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured
Published: 2023-04-28T21:26:12.202Z
Updated: 2025-01-30T18:25:51.209Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25492 |
vulnerable | 2026-06-08 05:56:09.037194 |
Details available
MEDIUM (6.3)
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API.
Published: 2023-05-01T14:11:48.551Z
Updated: 2025-01-30T15:53:03.655Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0683 |
vulnerable | 2026-06-08 05:52:32.428881 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34888 |
vulnerable | 2026-06-08 05:46:03.955655 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34884 |
vulnerable | 2026-06-08 05:46:03.915934 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.