CVE-2020-15712

CVE-2020-15712 affects rConfig 3.9.5. A remote authenticated attacker can traverse directories by sending a crafted request to ajaxGetFileByPath.php with hexadecimal encoded dot-dot sequences (%2f..%2f) in the path, allowing viewing arbitrary files on the system. Multiple sources (NVD, Red Hat, C...

CVE-2020-15712

rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to the ajaxGetFileByPath.php script containing hexadecimal encoded "dot dot" sequences %2f..%2f in the path parameter to view arbitrary files on the system...

rConfig <= 3.9.4 Multiple SQL Injection Vulnerabilities

rConfig is prone to multiple SQL injection vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

rConfig SQL Injection Vulnerability (CNVD-2020-38218)

rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...

rConfig SQL Injection Vulnerability (CNVD-2020-38220)

rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...

rConfig SQL Injection Vulnerability (CNVD-2020-38219)

rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...

rConfig SQL Injection Vulnerability (CNVD-2020-38217)

rConfig is an open source network configuration management utility . A SQL injection vulnerability exists in rConfig 3.9.4 and earlier versions, which stems from the program storing node passwords in plaintext. An attacker can exploit this vulnerability to access a listened network device...

CVE-2020-10548

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10548

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10549

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10549

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10547

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10546

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10546

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10547

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

Sql injection

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

Sql injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

Sql injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

Sql injection

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10546

rConfig 3.9.4 and earlier versions are affected by an unauthenticated SQL injection in compliancepolicies.inc.php. The underlying issue is that passwords are stored in plaintext by default, enabling an attacker to execute arbitrary SQL queries and potentially move laterally to access monitored ne...