Host header injection without proven business impact.Clickjacking on pages with no sensitive actions.Best practices violations (password complexity, expiration, re-use, etc.).Bypassing rate-limits or the non-existence of rate-limits.Presence of autocomplete attribute on web forms.Cross-site Request Forgery with no or low impact.CORS misconfiguration on non-sensitive endpoints.Verbose messages/files/directory listings without disclosing any sensitive information.Self-XSS that cannot be used to exploit other users.Pre-auth account takeover / oauth squatting.Old versions of the on-premises software.Third party services or plugins on the in-scope domains, such as:.The usage of Lansweeper licenses is only to be used for the purpose of ethical hacking, and not to manage your own IT estate. Scanners also won't improve your skills, and can cause a high server load (we'd like to put our time in thanking researchers rather than blocking their IP's 😉) Please do not use automatic scanners -be creative and do it yourself! We cannot accept any submissions found by using automatic scanners. Please do not register public CVEs without our consent Please do not discuss or post metadata about vulnerabilities or the company name without our consent. Please do not discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo) Provide detailed but to-the point reproduction steps We are happy to respond to any questions, please use the button in the right top corner for this.

We will respond to reports as soon as possible.

Lansweeper agent install