Skip to content
OpenAdvisories
Critical ICSA-19-211-02 9 CVEs

Prima Systems FlexAir

Published Jul 30, 2019 · Updated Jul 30, 2019

Vendor: Prima Systems Product: Prima FlexAir

Summary

Exploitation of these vulnerabilities may allow an attacker to execute commands directly on the operating system, upload malicious files, perform actions with administrative privileges, execute arbitrary code in a user 's browser, discover login credentials, bypass normal authentication, and have full system access.

Vulnerabilities 9

  • Unscored —
    CVE-2019-7280

    Prima Systems FlexAir, Versions 2.3.38 and prior. The session-ID is of an insufficient length and can be exploited by b…

  • Unscored —
    CVE-2019-7281

    Prima Systems FlexAir, Versions 2.3.38 and prior. An unauthenticated user can send unverified HTTP requests, which may …

  • Unscored —
    CVE-2019-7666 Public exploit EPSS 15%

    Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash val…

  • Unscored —
    CVE-2019-7667

    Prima Systems FlexAir, Versions 2.3.38 and prior. The application generates database backup files with a predictable na…

  • Unscored —
    CVE-2019-7669 EPSS 31%

    Prima Systems FlexAir, Versions 2.3.38 and prior. Improper validation of file extensions when uploading files could all…

  • Unscored —
    CVE-2019-7670 Public exploit EPSS 18%

    Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could m…

  • Unscored —
    CVE-2019-7671 Public exploit

    Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being re…

  • Unscored —
    CVE-2019-7672

    Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username…

  • Unscored —
    CVE-2019-9189 Public exploit EPSS 11%

    Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when…

Revision history

  1. #1

    ICSA-19-211-02 Prima Systems FlexAir

References