CVE-2021-38168

Roxy-WI through 5.2.2.0 allows authenticated SQL injection via selectservers...

CVE-2021-38168

Roxy-WI through 5.2.2.0 allows authenticated SQL injection via selectservers...

CVE-2021-38168

CVE-2021-38168 affects Roxy-WI up to version 5.2.2.0, where an authenticated user can trigger a SQL injection via the select_servers endpoint. The connected documents consistently describe this vulnerability as a SQL injection in Roxy-WI’s web interface for managing HAProxy/Nginx/Keepalived, with...

CVE-2021-38169

Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/apifunct.py...

CVE-2021-38169

Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/apifunct.py...

CVE-2021-38169

Roxy-WI is affected by CVE-2021-38169. The vulnerability allows command injection in versions up to 5.2.2.0 via unsafe handling in /app/funct.py and /api/api_funct.py. Impact is described as command execution, with risk details provided in the CVE entry (NVD metrics show high impact in confidenti...

CVE-2021-38167

Roxy-WI through 5.2.2.0 allows SQL Injection via checklogin. An unauthenticated attacker can extract a valid uuid to bypass authentication...

CVE-2021-38167

The CVE-2021-38167 issue affects Roxy-WI up to version 5.2.2.0, where a SQL Injection vulnerability in the check_login flow can allow an unauthenticated attacker to extract a valid uuid and bypass authentication. Affected component: Roxy-WI web interface; root cause: improper handling of login in...

CVE-2021-38167

Roxy-WI through 5.2.2.0 allows SQL Injection via checklogin. An unauthenticated attacker can extract a valid uuid to bypass authentication...

Roxy-WI SQL injection vulnerability

Roxy-WI is a web interface for managing Haproxy, Nginx, and Keepalived servers. SQL injection vulnerabilities exist in Roxy-WI 5.2.2.0 and earlier versions, and attackers can use checklogin to extract a valid uuid to bypass authentication...

Roxy-WI command injection vulnerability

Roxy-WI, the web interface for managing Haproxy, Nginx, and Keepalived servers, is vulnerable to a command injection vulnerability in Roxy-WI 5.2.2.0 and earlier. An attacker can exploit this vulnerability to conduct command injection attacks via /app/funct.py and /api/apifunct.py...

PT-2021-21980

Name of the Vulnerable Software and Affected Versions: Roxy-WI versions 5.2.2.0 and earlier Description: The issue allows command injection via the "/app/funct.py" and "/api/api funct.py" API endpoints. This can potentially be exploited to execute unauthorized commands. Recommendations: For Roxy-...

PT-2021-21979

Name of the Vulnerable Software and Affected Versions: Roxy-WI versions 5.2.2.0 and earlier Description: The issue allows authenticated SQL injection via the select servers endpoint. This could potentially be exploited by authenticated attackers to inject malicious SQL code. Recommendations: For...

PT-2021-21978

Name of the Vulnerable Software and Affected Versions: Roxy-WI versions 5.2.2.0 and earlier Description: The issue allows SQL Injection via the check login function, enabling an unauthenticated attacker to extract a valid uuid and bypass authentication. Recommendations: For Roxy-WI versions 5.2.2...

CVE-2021-38167: Improper Neutralization of Special Elements used in an SQL Command

Roxy-WI through 5.2.2.0 allows SQL Injection via checklogin. An unauthenticated attacker can extract a valid uuid to bypass authentication...

CVE-2021-38168: Improper Neutralization of Special Elements used in an SQL Command

Roxy-WI through 5.2.2.0 allows authenticated SQL injection via selectservers...

CVE-2021-38169: Improper Neutralization of Special Elements used in a Command

Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/apifunct.py...

Roxy-WI SQL injection vulnerability

Roxy-WI is a web interface for managing Haproxy, Nginx, and Keepalived servers. SQL injection vulnerabilities exist in Roxy-WI 5.2.2.0 and earlier versions, which can be exploited by attackers to conduct SQL injection attacks via selectservers...