Total
5 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-41551 | 1 Leostream | 1 Connection Broker | 2024-11-21 | 4.0 MEDIUM | 4.9 MEDIUM |
| Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link. | |||||
| CVE-2021-41550 | 1 Leostream | 1 Connection Broker | 2024-11-21 | 6.5 MEDIUM | 7.2 HIGH |
| Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code. | |||||
| CVE-2021-38157 | 1 Leostream | 1 Connection Broker | 2024-11-21 | 4.3 MEDIUM | 6.1 MEDIUM |
| LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer | |||||
| CVE-2020-26574 | 1 Leostream | 1 Connection Broker | 2024-11-21 | 9.3 HIGH | 9.6 CRITICAL |
| Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a malicious Perl script that will be executed as root via libMisc::browser_client. NOTE: This vulnerability only affects products that are no longer supported by the maintainer | |||||
| CVE-2018-18817 | 1 Leostream | 2 Agent, Connection Broker | 2024-11-21 | 5.0 MEDIUM | 7.5 HIGH |
| The Leostream Agent before Build 7.0.1.0 when used with Leostream Connection Broker 8.2.72 or earlier allows remote attackers to modify registry keys via the Leostream Agent API. | |||||