CVE-2020-23148

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

EUVD-2020-15903

Malware in sbrugna...

CVE-2020-15715

rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. An attacker could exploit this vulnerability using the nodeId parameter...

CVE-2020-23150

A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php...

CVE-2020-25353

A server-side request forgery SSRF vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters...

CVE-2020-25359

An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted request to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php by specifying a path in the path parameter and an extension in the ext parameter and delet...

CVE-2020-25359

The CVE-2020-25359 issue affects rConfig 3.9.5 and is fixed in 3.9.6. An attacker can delete arbitrary files by crafting a request to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php, supplying a path in the path parameter and an extension in the ext parameter to delete all files with that extensi...

CVE-2020-23149

The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database information...

CVE-2020-23148

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

Sql injection

The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database information...

Design/Logic Flaw

The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request...

Sql injection

A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php...

CVE-2020-23151

CVE-2020-23151 concerns rConfig 3.9.5, where a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php can trigger command injection because the path parameter is passed directly to exec without escaping. Multiple sources (Red Hat, NVD, CNNVD, PRION, OpenVAS, CVE list) corroborate this singl...

CVE-2020-23150

A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php...

CVE-2020-23150

CVE-2020-23150 concerns rConfig 3.9.5. Concrete details in the connected docs show a SQL injection vulnerability in config.inc.php that can be exploited by sending a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php to access sensitive database information. Affected software: rCon...

CVE-2020-23148

CVE-2020-23148 affects rConfig 3.9.5 via a vulnerability in the LDAP login path. The issue is the unsanitized userLogin parameter in ldap/login.php , which can lead to a LDAP injection and potential exposure of sensitive information through a crafted POST request. Public references consistently d...

CVE-2020-15714

rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using the customLocation parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database...

CVE-2020-15715

rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. An attacker could exploit this vulnerability using the nodeId parameter...

Code injection

rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. An attacker could exploit this vulnerability using the nodeId parameter...

CVE-2020-15715

rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. An attacker could exploit this vulnerability using the nodeId parameter...