← Vulnerability feed

Vulnerability record · CVE-2019-19757 · published 14 February 2020

CVE-2019-19757: Lenovo xclarity administrator cross-site scripting vulnerability

Lenovo · Xclarity Administrator

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself.

5.4 CVSS 3.1 Medium EPSS 0.52% · top 57.1% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score, v2 3.5
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.lenovo.com/us/en/product_security/LEN-29477 Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-29477 Vendor Advisory

Track CVE-2019-19757 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-17833Openslp memory buffer overflow vulnerabilityOpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or …EPSS 3.8%9.8CVE-2016-8233Lenovo xclarity administrator sensitive information in log file vulnerabilityLog files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form…EPSS 1.1%8.8CVE-2018-9066Lenovo xclarity administrator improper input validation vulnerabilityIn Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional paramet…EPSS 2.2%8.8CVE-2018-9064Lenovo xclarity administrator vulnerabilityIn Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials f…EPSS 0.96%8.8CVE-2017-3770Lenovo xclarity administrator vulnerabilityPrivilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interface functio…EPSS 1.0%8.1CVE-2023-34418Lenovo xclarity administrator sql injection vulnerabilityA valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to a SQL injection vulnerability…EPSS 0.55%7.8CVE-2017-3745Lenovo xclarity administrator improper authentication vulnerabilityIn Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password …EPSS 0.40%7.5CVE-2023-3113Lenovo xclarity administrator xml external entity (xxe) vulnerabilityAn unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read…EPSS 0.50%

Source: NIST National Vulnerability Database (record CVE-2019-19757), CISA KEV, FIRST EPSS (scores of 2026-10-15). This page is refreshed as NVD updates the record.