516 matches found
CVE-2019-19509
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution...
CVE-2019-19585
CVE-2019-19585 affects rConfig 3.9.x, where the install script alters /etc/sudoers during an rConfig Apache-related update, giving Apache high privileges for certain binaries and enabling bypass of local security restrictions. Public materials describe chained vulnerabilities (including CVE-2019-...
CVE-2019-19585
An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apache configuration" update, apache has high privileges for some binaries. This can be exploited by an attacker to bypass local security restrictions...
CVE-2019-19509
An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution. Recent assessments: Assesse...
PT-2020-1558 · Apache +1 · Apache +1
Name of the Vulnerable Software and Affected Versions: rConfig version 3.9.3 Description: An issue in rConfig allows an attacker to bypass local security restrictions due to insecure privilege management in the /etc/sudoers file. This occurs after an update to the rConfig specific Apache...
VulnCheck KEV: CVE-2019-16662
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution...
rConfig path traversal vulnerability
rConfig is an open source network configuration management utility . A path traversal vulnerability exists in rConfig 3.9.3 and earlier versions. The vulnerability stems from a failure of a network system or product to properly filter for special elements in a resource or file path. An attacker...
CVE-2019-19372
A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit...
CVE-2019-19372
A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit...
Path traversal
DISPUTED A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit."...
CVE-2019-19372
CVE-2019-19372 affects rConfig up to version 3.9.3, where a path traversal flaw in downloadFile.php allows listing files in arbitrary folders and potentially downloading files. Root cause is unsafe handling of file paths in download_file, enabling access outside restricted directories. Public sou...
CVE-2019-19372
A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit...
CVE-2019-19372
A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit...
PT-2019-15823 · Rconfig · Rconfig
Name of the Vulnerable Software and Affected Versions: rConfig versions 3.9.3 and earlier Description: A downloadFile.php download file path traversal issue allows attackers to list files in arbitrary folders and potentially download files. The discoverer reported that there was not a fully worki...
Exploit for CVE-2019-19268
CVE-2019-19268 Affected Version: rConfig 3.9.2. Descriptio...
rConfig <= 3.9.2 Authenticated SQL Injection Vulnerability
rConfig is prone to an authenticated SQL injection vulnerability in devices.php?searchColumn=. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-lat...
rConfig SQL Injection Vulnerability (CNVD-2020-41583)
rConfig is an open source network device configuration management utility . A SQL injection vulnerability exists in rConfig version 3.9.2, which stems from a lack of validation of externally entered SQL statements in database-based applications, and can be exploited by an attacker to execute...
CVE-2019-19207
rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...