CVE-2023-24366

CVE-2023-24366 affects rConfig v6.8.0 . The vulnerability is described as an arbitrary file download via a crafted HTTP request, exposing sensitive files and yielding a CONFIDENTIALITY impact: HIGH with no integrity/availability impact. The NVD/CNA entries assign a CVSS v3.1 base score 6.5 (MEDIU...

rConfig 安全漏洞

rConfig is an open source network configuration management utility. A security vulnerability exists in rConfig version v6.8.0, which stems from the presence of an arbitrary file download vulnerability that can be exploited by an attacker to download sensitive files via a crafted HTTP request...

PT-2023-19530 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig version 6.8.0 Description: The issue allows attackers to download sensitive files via a crafted HTTP request, potentially exposing sensitive information. Recommendations: For rConfig version 6.8.0, at the moment, there is no informati...

CVE-2023-24366

An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request...

The vulnerability of the lib/ajaxHandlers/ajaxAddTemplate.php component, a utility for managing network device configurations using the rConfig protocol, allows a attacker to execute arbitrary operating system commands.

The vulnerability of the lib/ajaxHandlers/ajaxAddTemplate.php utility, which is used to manage network device configurations in the rConfig framework, exists because special elements used in the operating system command are not properly eliminated. Exploiting this vulnerability allows a malicious...

rConfig <= 3.x Multiple Vulnerabilities

rConfig is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rconfig:rconfig"; if description...

rConfig <= 3.x Arbitrary File Upload Vulnerability

rConfig is prone to an arbitrary file upload vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rconfig:rconfig"; if...

CVE-2022-44384

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-44384

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file...

Privilege escalation

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file...

rConfig 代码问题漏洞

rConfig is an open source network configuration management utility. A security vulnerability exists in rConfig version v3.9.6. An attacker exploits the vulnerability to execute arbitrary code via specially crafted PHP files...

CVE-2022-44384

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-44384

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-44384

CVE-2022-44384 affects rconfig v3.9.6 and describes an arbitrary file upload vulnerability that allows an attacker to execute arbitrary PHP code by uploading a crafted file. The issue enables remote code execution via a crafted PHP file, with in‑the‑wild risk demonstrated by a Metasploit module t...

PT-2022-27205 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rconfig version 3.9.6 Description: An arbitrary file upload issue allows attackers to execute arbitrary code via a crafted PHP file. Recommendations: For rconfig version 3.9.6, update to a version that fixes this issue, as the current version...

Fidelis Network Deception Command Injection Vulnerability (CNVD-2022-59170)

Fidelis Network Deception is a security product from Fidelis USA. A security vulnerability exists in versions prior to Fidelis Network Deception 9.4.5, which stems from a problem with date in rconfig. An attacker with CLI user-level access could exploit the vulnerability to inject root-level...

CVE-2022-24389

Vulnerability in rconfig “certutils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis...

CVE-2022-24390

Vulnerability in rconfig “remotetextfile” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fideli...

CVE-2022-24388

Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network...

Design/Logic Flaw

Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnerability is present in Fidelis Network...