CVE-2019-19756

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are only accessible to authorized users in the First Failure Data Capture (FFDC) service log and log files on LXCA.

• CWE-532
• CWE-532

• https://support.lenovo.com/us/en/product_security/LEN-29942Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-29942Vendor Advisory

Published

Mar 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19750minerstat msOS before 2019-10-23 does not have a unique SSH …9.8
• CVE-2019-19751easyMINE before 2019-12-05 ships with SSH host keys baked in…5.6
• CVE-2019-19752nvOC through 3.2 ships with SSH host keys baked into the ins…9.8
• CVE-2019-19753SimpleMiningOS through v1259 ships with SSH host keys baked …9.1
• CVE-2019-19754HiveOS through 0.6-102@191212 ships with SSH host keys baked…5.7
• CVE-2019-19755ethOS through 1.3.3 ships with SSH host keys baked into the …9.1
• CVE-2019-19757An internal product security audit of Lenovo XClarity Admini…5.4
• CVE-2019-19758A vulnerability in the web interface of Lenovo EZ Media & Ba…6.1
• CVE-2019-19759Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2019-1976A vulnerability in the “plug-and-play” services …9.8
• CVE-2019-19760Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2019-19761Rejected reason: This CVE ID has been rejected or withdrawn …