CVE-2020-10546

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10547

Affected software: rConfig (3.9.4 and earlier). Root cause: unauthenticated SQL injection in compliancepolicyelements.inc.php; vulnerability stems from plaintext storage of node passwords by default. Impact: allows execution of arbitrary SQL queries and lateral movement to gain access to monitore...

CVE-2020-10547

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10548

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10548

rConfig 3.9.4 and earlier are affected by unauthenticated SQL injection in devices.inc.php. Multiple sources (NVD, Nuclei template, OpenVAS, CNVD, Red Hat advisory) describe an SQL injection that can be exploited without authentication, with node passwords stored in plaintext by default, enabling...

CVE-2020-10549

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10549

CVE-2020-10549 affects rConfig 3.9.4 or apply the patch. Exploitation details are not provided in the sources; several advisories/StIX-like feeds confirm the presence of SQL injection vectors without product-specific exploit steps.

CVE-2020-10548: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10547

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. Recent assessments: thegul...

CVE-2020-10546: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10549

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. Recent assessments: theguly at June 04, 20...

CVE-2020-10548

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. Recent assessments: theguly at June 04, 202...

CVE-2020-10549: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10547: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

CVE-2020-10546

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes’ passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. Recent assessments: theguly at...

rConfig code issue vulnerability

rConfig is an open source network configuration management utility . rConfig 3.9.4 version of the vendor.crud.php file has a code problem vulnerability , the vulnerability stems from the file upload function is not properly validated , an attacker can upload a .php file containing arbitrary PHP...

rConfig Authorization Issues Vulnerability

rConfig is an open source network configuration management utility . An authorization issue vulnerability exists in rConfig version 3.9.4. An attacker could exploit this vulnerability to access other user sessions...

rConfig Cross-Site Scripting Vulnerability

rConfig is an open source network configuration management utility . A cross-site scripting vulnerability exists in the devicemgmnt.php file in version 3.9.4 of rConfig. The vulnerability stems from the lack of proper validation of client-side data in the WEB application, and can be exploited by ...

rConfig cross-site scripting vulnerability (CNVD-2020-33652)

rConfig is an open source network configuration management utility . A cross-site scripting vulnerability exists in the devicemgmnt.php file in version 3.9.4 of rConfig. The vulnerability stems from the lack of proper validation of client-side data in the WEB application, and can be exploited by ...

rConfig Cross-Site Request Forgery Vulnerability

rConfig is an open source network configuration management utility . A cross-site request forgery vulnerability exists in rConfig version 3.9.4, which stems from the program not properly validating user input. A remote attacker can exploit this vulnerability to perform malicious actions via...