CVE-2019-7671

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/155274/Prima-Access-Control-2.3.35-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://applied-risk.com/index.php/download_file/view/199/165Broken Link
https://applied-risk.com/labs/advisoriesNot Applicable, Third Party Advisory
https://applied-risk.com/resources/ar-2019-007Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-211-02Third Party Advisory, US Government Resource
http://packetstormsecurity.com/files/155274/Prima-Access-Control-2.3.35-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://applied-risk.com/index.php/download_file/view/199/165Broken Link
https://applied-risk.com/labs/advisoriesNot Applicable, Third Party Advisory
https://applied-risk.com/resources/ar-2019-007Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-211-02Third Party Advisory, US Government Resource

Timeline

Published: Jun 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-76728.8Prima Systems FlexAir, Versions 2.3.38 and prior. The flash version of the web interface contains a hard-coded username and password, which CVE-2019-76737.5An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. Administrator Credentials are stored in the 13-character DES hash format.CVE-2019-76749.8An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. /admin/access accepts a request to set the "aaaaa" password, considered insecur CVE-2019-76757.5An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. The default management application is delivered over cleartext HTTP with Basic CVE-2019-76767.2A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 8888 with the admin password for the admin CVE-2019-76776.1XSS exists in Enphase Envoy R3.*.* via the profileName parameter to the /home URI on TCP port 8888.CVE-2019-76789.8A directory traversal vulnerability was discovered in Enphase Envoy R3.*.* via images/, include/, include/js, or include/css on TCP port 888 CVE-2019-76849.8inxedu through 2018-12-24 has a vulnerability that can lead to the upload of a malicious JSP file. The vulnerable code location is com.inxed CVE-2019-76876.1cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization i CVE-2019-76909.8In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the li CVE-2019-76929.8install/install.php in CIM 0.9.3 allows remote attackers to execute arbitrary PHP code via a crafted prefix value because of configuration f CVE-2019-76936.1Axios Italia Axios RE 1.7.0/7.0.0 devices have XSS via the RELogOff.aspx Error_Parameters parameter. In some situations, the XSS would be on