Lansweeper 7.2 Default Account / Remote Code Execution

Exploit Title: Lansweeper 7.2 - Incorrect Access Control SHODAN DORK : title:"Lansweeper - Login" Date: 2020-06-14 Exploit Author: Amel BOUZIANE-LEBLOND Vendor Homepage: https://www.lansweeper.com/ Software Link: https://www.lansweeper.com Version: 6.0.x through 7.2.x Tested on: Windows CVE :...

Lansweeper 7.2 - Incorrect Access Control

Exploit Title: Lansweeper 7.2 - Incorrect Access Control SHODAN DORK : title:"Lansweeper - Login" Date: 2020-06-14 Exploit Author: Amel BOUZIANE-LEBLOND Vendor Homepage: https://www.lansweeper.com/ Software Link: https://www.lansweeper.com Version: 6.0.x through 7.2.x Tested on: Windows CVE :...

Lansweeper Command Execution Vulnerability

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A security vulnerability exists in Lansweeper versions 6.0.x through 7.2.x. The vulnerability can be exploited via the Add New Package and...

CVE-2020-14011

Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features...

CVE-2020-14011

Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features...

Command injection

Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features...

CVE-2020-14011

Lansweeper 6.0.x through 7.2.x has a default installation in which the admin password is configured for the admin account, unless "Built-in admin" is manually unchecked. This allows command execution via the Add New Package and Scheduled Deployments features...

CVE-2020-14011

CVE-2020-14011 affects Lansweeper 6.0.x–7.2.x. The default installation leaves the admin password configured for the admin account unless the built-in admin option is unchecked, enabling command execution via Add New Package and Scheduled Deployments. Multiple sources (NVD/Red Hat/CNVD/Exploits d...

Lansweeper Cross-Site Scripting Vulnerability (CNVD-2020-03133)

Lansweeper is an IT asset management system. A cross-site scripting vulnerability exists in the Web console in Lansweeper version 7.2.105.2. The vulnerability stems from the WEB application lacking proper validation of client-side data. An attacker can exploit the vulnerability to execute...

CVE-2019-18955

The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...

CVE-2019-18955

The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...

Path traversal

The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...

CVE-2019-18955

The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...

CVE-2019-18955

Affected product: Lansweeper Web Console (version 7.2.105.2). Vulnerability: Cross-Site Scripting (XSS) via the URL path, stemming from improper handling of client-side data in the web console. Impact as described in sources is limited to client-side script execution; no server-side compromise de...

Lansweeper SQL Injection Vulnerability

Lansweeper is an IT asset management system. A SQL injection vulnerability exists in Lansweeper versions prior to 7.1.117.4, which stems from a lack of validation of externally-entered SQL statements in database-based applications and can be exploited by an attacker to execute illegal SQL command...

CVE-2019-13462

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection...

CVE-2019-13462

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection...

Sql injection

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection...

CVE-2019-13462

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection...

CVE-2019-13462

CVE-2019-13462 affects Lansweeper before 7.1.117.4, described as an unauthenticated SQL injection. The connected documents clearly identify the affected software (Lansweeper) and the vulnerable component/condition (SQL injection without authentication) with versions prior to 7.1.117.4. The exploi...