Sql injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10546

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10546

rConfig 3.9.4 and earlier versions are affected by an unauthenticated SQL injection in compliancepolicies.inc.php. The underlying issue is that passwords are stored in plaintext by default, enabling an attacker to execute arbitrary SQL queries and potentially move laterally to access monitored ne...

CVE-2020-10547

Affected software: rConfig (3.9.4 and earlier). Root cause: unauthenticated SQL injection in compliancepolicyelements.inc.php; vulnerability stems from plaintext storage of node passwords by default. Impact: allows execution of arbitrary SQL queries and lateral movement to gain access to monitore...

CVE-2020-10547

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10547

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10548

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10548

rConfig 3.9.4 and earlier are affected by unauthenticated SQL injection in devices.inc.php. Multiple sources (NVD, Nuclei template, OpenVAS, CNVD, Red Hat advisory) describe an SQL injection that can be exploited without authentication, with node passwords stored in plaintext by default, enabling...

CVE-2020-10548

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10549

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10547: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10548

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. Recent assessments: theguly at June 04, 202...

PT-2020-12195

Name of the Vulnerable Software and Affected Versions rConfig versions 3.9.4 and previous versions Description The issue is related to an unauthenticated SQL injection in compliancepolicies.inc.php, which can lead to lateral movement. Since nodes' passwords are stored in cleartext by default, an...

PT-2020-12197

Name of the Vulnerable Software and Affected Versions rConfig versions 3.9.4 and earlier Description The issue is related to an unauthenticated SQL injection in devices.inc.php, which can lead to lateral movement. Since nodes' passwords are stored in cleartext by default, an attacker can gain...

CVE-2020-10549: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10546

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. Recent assessments: theguly at...

CVE-2020-10547

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. Recent assessments: thegul...

CVE-2020-10549

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. Recent assessments: theguly at June 04, 20...

CVE-2020-10548: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

PT-2020-12196

Name of the Vulnerable Software and Affected Versions rConfig versions 3.9.4 and earlier Description The issue is related to an unauthenticated SQL injection in compliancepolicyelements.inc.php, which can lead to lateral movement. Since nodes' passwords are stored in cleartext by default, an...