Primasystems Flexair
10 CVEs affecting Primasystems Flexair. Latest disclosed: 2019-07-01. Critical: 3, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-7668 | Critical | 9.8 | 2019-07-01 | Prima Systems FlexAir devices have Default Credentials. |
CVE-2019-7667 | Critical | 9.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable name, and an attacker can use brute force… |
CVE-2019-7671 | Critical | 9.0 | 2019-06-05 | Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an a… |
CVE-2019-7669 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. Improper validation of file extensions when uploading files could allow a remote authenticated attacker to up… |
CVE-2019-7666 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an a… |
CVE-2019-7281 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may allow the attacker to perform certain ac… |
CVE-2019-7280 | High | 8.8 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by brute force, which may allow a remote att… |
CVE-2019-7672 | High | 8.8 | 2019-06-05 | Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authen… |
CVE-2019-9189 | High | 8.8 | 2019-06-05 | Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller… |
CVE-2019-7670 | High | 7.2 | 2019-07-01 | Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is… |