CVE-2019-19756

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are only accessible to authorized users in the First Failure Data Capture (FFDC) service log and log files on LXCA.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Lenovo	XClarity Administrator (LXCA)	>= unspecified, < 2.6.12

References

https://support.lenovo.com/us/en/product_security/LEN-29942Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-29942Vendor Advisory

Timeline

Published: Mar 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-197575.4An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripti CVE-2019-197586.1A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthe CVE-2019-19769.8A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could allow an unauthentica CVE-2019-197667.5The Bitwarden server through 1.32.0 has a potentially unwanted KDF.CVE-2019-197675.5The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and CVE-2019-197687.5In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to CVE-2019-197696.7In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h CVE-2019-19777.5A vulnerability within the Endpoint Learning feature of Cisco Nexus 9000 Series Switches running in Application Centric Infrastructure (ACI)CVE-2019-197708.2In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove CVE-2019-197718.8The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In part CVE-2019-197725.4Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are avail CVE-2019-197735.4Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are availabl