dnaTools dnaLIMS 4-2015s13 vulnerabilities
4 known CVE vulnerabilities in dnaTools dnaLIMS 4-2015s13, translated and rated.
- CVE-2017-6529High
An issue was discovered in dnaTools dnaLIMS version 4-2015s13 related to session hijacking by guessing the UID parameter.
- CVE-2017-6528High
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to plaintext password storage. The /home/dna/spool/.pfile file contains passwords in plain text.
- CVE-2017-6527High
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user.
- CVE-2017-6526Critical
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi in POST requests).