CVE-2019-19372

A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit...

Path traversal

DISPUTED A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit."...

CVE-2019-19372

A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit...

CVE-2019-19372

A downloadFile.php downloadfile path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in arbitrary folders and potentially download files. NOTE: the discoverer later reported that there was not a "fully working exploit...

CVE-2019-19372

CVE-2019-19372 affects rConfig up to version 3.9.3, where a path traversal flaw in downloadFile.php allows listing files in arbitrary folders and potentially downloading files. Root cause is unsafe handling of file paths in download_file, enabling access outside restricted directories. Public sou...

PT-2019-15823 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig versions 3.9.3 and earlier Description: A downloadFile.php download file path traversal issue allows attackers to list files in arbitrary folders and potentially download files. The discoverer reported that there was not a fully worki...

Exploit for CVE-2019-19268

CVE-2019-19268 Affected Version: rConfig 3.9.2. Descriptio...

rConfig <= 3.9.2 Authenticated SQL Injection Vulnerability

rConfig is prone to an authenticated SQL injection vulnerability in devices.php?searchColumn=. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-lat...

rConfig SQL Injection Vulnerability (CNVD-2020-41583)

rConfig is an open source network device configuration management utility . A SQL injection vulnerability exists in rConfig version 3.9.2, which stems from a lack of validation of externally entered SQL statements in database-based applications, and can be exploited by an attacker to execute...

CVE-2019-19207

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...

CVE-2019-19207

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...

Sql injection

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...

CVE-2019-19207

rConfig 3.9.2 allows devices.php?searchColumn= SQL injection...

CVE-2019-19207

CVE-2019-19207 affects rConfig 3.9.2, where an SQL injection is possible via devices.php?searchColumn=. The root cause is lack of input validation in the application that allows SQL statements to be injected. Impact is high across confidentiality, integrity, and availability (per CVSS 3.1: 8.8; p...

rConfig - install Command Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'rConfig install Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability in rConfig version...

rConfig - install Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'rConfig install Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability in rConfig version...

rConfig 3.9.2 Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'rConfig install Command Execution', 'Description' = %q This module exploits an unauthenticated command injection vulnerability in rConfig version...

PT-2019-4524 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig version 3.9.3 Description: The issue is related to errors in handling HTTP requests in the ajaxArchiveFiles.php component of the rConfig utility for managing network device configurations. Exploitation of this issue may allow a remote...

rConfig Remote Code Execution (CVE-2019-16662; CVE-2019-16663)

A remote code execution vulnerability exists in rConfig. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

rConfig < 3.9.3 Multiple RCE Vulnerabilities - Version Check

rConfig is prone to multiple remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...