leostream vulnerabilities

Products

• connection broker 5
• agent 1

Latest leostream CVEs

Newest publication first

1. CVE-2021-41550 Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.

   Published 2022-01-18

   High·CVSS 7.2 EPSS 0.99%

   Leostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.

2. CVE-2021-41551 Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link.

   Published 2022-01-18

   Medium·CVSS 4.9 EPSS 1.3%

   Leostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal attacks by uploading z ZIP file that contains a symbolic link.

3. CVE-2021-38157 LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by th...

   Published 2021-08-06

   Medium·CVSS 6.1 EPSS 1.1%

   LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

4. CVE-2020-26574 Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins t...

   Published 2020-10-06

   Critical·CVSS 9.6 EPSS 2.1%

   Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin...

5. CVE-2018-18817 The Leostream Agent before Build 7.0.1.0 when used with Leostream Connection Broker 8.2.72 or earlier allows remote attackers to modify registry keys via the Leostream Agent API.

   Published 2018-10-30

   High·CVSS 7.5 EPSS 1.1%

   The Leostream Agent before Build 7.0.1.0 when used with Leostream Connection Broker 8.2.72 or earlier allows remote attackers to modify registry keys via the Leostream Agent API.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.