176 matches found
CVE-2019-13462
Lansweeper before 7.1.117.4 allows unauthenticated SQL injection...
VulnCheck KEV: CVE-2019-13462
Lansweeper before 7.1.117.4 allows unauthenticated SQL injection...
Lansweeper Credential Collector
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Lansweeper Credential Collector', 'Description' = %q Lansweeper stores the credentials it uses to scan the computers in its Microsoft SQL databas...
CVE-2022-28703
A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-32763
A cross-site scripting xss sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-32573
A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-32763
A cross-site scripting xss sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-32573
A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-29511
Cisco Talos and Lansweeper detail a directory traversal vulnerability in Lansweeper 10.1.1.0, triggered via KnowledgebasePageActions.aspx ImportArticles. The flaw arises from unsanitized file_path handling in CSV imports, allowing reading arbitrary server files. Exploitation is demonstrated in Ta...
CVE-2022-32763
CVE-2022-32763 is a high-severity XSS bypass in Lansweeper 10.1.1.0, involving the SanitizeHtml function. Talos confirms a bypass of sanitization that allows arbitrary JavaScript injection via a specially crafted HTTP request. The vulnerability affects how user-provided HTML content is sanitized,...
CVE-2022-29511
A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-27498
A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-28703
Summary: CVE-2022-28703 is a stored cross-site scripting vulnerability in Lansweeper 10.1.1.0, exposed via the HdConfigActions.aspx altertextlanguages functionality. Affected software: Lansweeper, version 10.1.1.0 (HdConfigActions.aspx handling in the configuration/news language alteration path)....
CVE-2022-27498
CVE-2022-27498 is a directory traversal vulnerability in Lansweeper 10.1.1.0, exposed through TicketTemplateActions.aspx GetTemplateAttachment. The vulnerability allows an attacker to read arbitrary files via a crafted HTTP request by manipulating fileuid and bypassing path restrictions, as demon...
CVE-2022-29517
A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-29517
CVE-2022-29517 is a directory traversal vulnerability in Lansweeper 10.1.1.0, affecting the HelpdeskActions.aspx edittemplate feature. Cisco Talos confirms an exploitable path where inline attachments (inlineattachment + inlineattachmentname) can be uploaded to arbitrary locations due to unsaniti...
CVE-2022-28703
A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-29511
A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-29517
A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-27498
A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...