CVE-2019-7669

CVE-2019-7669 affects Prima Systems FlexAir (versions 2.3.38 and earlier). The vulnerability is due to improper validation of file extensions when uploading files, allowing a remote authenticated attacker to upload and execute malicious applications within the application’s web root with root pri...

CVE-2019-7670

CVE-2019-7670 affects Prima Systems FlexAir (Versions 2.3.38 and earlier). The vulnerability is an OS command injection caused by improper neutralization of elements that could modify commands sent to downstream components. This could allow an attacker to execute commands on the operating system....

CVE-2019-7670

Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component, which could allow attackers to execute commands directly on the operating system...

PT-2019-18692 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The issue is related to improper validation of file extensions when uploading files. This could allow a remote authenticated attacker to upload and execute malicious applications...

PT-2019-18693 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The application fails to properly neutralize special elements, potentially allowing attackers to modify intended OS commands sent to downstream components. This could enable attacke...

PT-2019-18511 · Prima Systems · Flexair

Name of the Vulnerable Software and Affected Versions: Prima Systems FlexAir versions 2.3.38 and prior Description: The issue allows an unauthenticated user to send unverified HTTP requests. This may enable an attacker to perform certain actions with administrative privileges if a logged-in user...

Prima Systems FlexAir Script Upload Execution Vulnerability

Prima Systems FlexAir is an access control system from Prima Systems in Slovenia. A security vulnerability in Prima Systems FlexAir when configuring the main central controller allows remote attackers to exploit the vulnerability by submitting a special Python script request that can execute...

CVE-2019-7672

Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authenticated attacker to escalate privileges...

CVE-2019-7671

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site...

Design/Logic Flaw

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site...

CVE-2019-7672

Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authenticated attacker to escalate privileges...

Hardcoded credentials

Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authenticated attacker to escalate privileges...

CVE-2019-7671

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site...

CVE-2019-7671

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site...

CVE-2019-7671

CVE-2019-7671 affects Prima Systems FlexAir (Versions 2.3.38 and earlier). The issue is an authenticated Stored XSS vector where parameters sent to scripts are not properly sanitized, potentially allowing code execution in a user’s browser context. Public PoCs exist (e.g., HwName Stored XSS via P...

CVE-2019-7672

Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which may allow an authenticated attacker to escalate privileges...

CVE-2019-7672

Affected software: Prima Systems FlexAir, versions 2.3.38 and earlier. Vulnerability: Use of hard-coded username/password in the flash web interface enables an authenticated attacker to escalate privileges. Root cause: hard-coded credentials in the Web UI. Impact: potential privilege escalation o...

CVE-2019-9189

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker t...

CVE-2019-9189

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker t...

Design/Logic Flaw

Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker t...