Lucene search
+L

303 matches found

VulnCheck KEV
VulnCheck KEV
added 2025/06/03 12:0 a.m.4 views

VulnCheck KEV: CVE-2022-31161

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocessexecute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch...

10CVSS5.8AI score0.26819EPSS
SaveExploits3References1
RedhatCVE
RedhatCVE
added 2025/05/23 6:9 a.m.6 views

CVE-2023-25802

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.6.0 don't correctly neutralize dir/../filename sequences, such as /etc/nginx/../passwd, allowing an actor to gain information about a server. Version 6.3.6.0 has a patch for this issue...

7.5CVSS6.8AI score0.01012EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2025/05/22 8:8 p.m.8 views

CVE-2021-38167

Roxy-WI through 5.2.2.0 allows SQL Injection via checklogin. An unauthenticated attacker can extract a valid uuid to bypass authentication...

9.8CVSS8.2AI score0.01286EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/05/22 6:44 p.m.8 views

CVE-2021-38168

Roxy-WI through 5.2.2.0 allows authenticated SQL injection via selectservers...

8.8CVSS7.8AI score0.00939EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/05/22 6:41 p.m.9 views

CVE-2021-38169

Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/apifunct.py...

8.8CVSS7.5AI score0.01528EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/02/05 12:53 p.m.18 views

CVE-2024-43804

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...

8.8CVSS7.8AI score0.0256EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2025/02/04 11:51 p.m.11 views

CVE-2024-13129

A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function actionservice of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched...

9CVSS9.2AI score0.17797EPSS
SaveExploits0References1
NVD
NVD
added 2025/01/03 10:15 p.m.16 views

CVE-2024-13129

A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function actionservice of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched...

9CVSS0.17797EPSS
SaveExploits0References8
Vulnrichment
Vulnrichment
added 2025/01/03 9:31 p.m.14 views

CVE-2024-13129 Roxy-WI roxy.py action_service os command injection

A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function actionservice of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched...

9CVSS7.3AI score0.17797EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2025/01/03 9:31 p.m.72 views

CVE-2024-13129 Roxy-WI roxy.py action_service os command injection

A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function actionservice of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched...

9CVSS0.17797EPSS
SaveExploits0References8
OSV
OSV
added 2025/01/03 9:31 p.m.6 views

CVE-2024-13129 Roxy-WI roxy.py action_service os command injection

A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function actionservice of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched...

8.7CVSS6.6AI score0.17797EPSS
SaveExploits0References10
CVE
CVE
added 2025/01/03 9:31 p.m.60 views

CVE-2024-13129

CVE-2024-13129 affects Roxy-WI up to version 8.1.3. The vulnerability resides in action_service (file app/modules/roxywi/roxy.py): manipulating the action/service argument enables operating system command injection. The issue can be exploited remotely and publicly disclosed exploits exist. Mitiga...

9CVSS9.2AI score0.17797EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2025/01/03 12:0 a.m.8 views

PT-2025-2015 · Roxy-Wi · Roxy-Wi

Name of the Vulnerable Software and Affected Versions: Roxy-WI versions up to 8.1.3 Description: A critical issue has been found in Roxy-WI, affecting the action service function of the file app/modules/roxywi/roxy.py. The manipulation of the action/service argument leads to os command injection...

9CVSS9.2AI score0.17797EPSS
SaveExploits0References14
BDU FSTEC
BDU FSTEC
added 2024/09/09 12:0 a.m.6 views

The vulnerability of the scanning function for web interface ports in the Roxy-WI server management solutions Haproxy, Nginx, Apache, and Keepalived allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the scanning function of the Roxy-WI web interface for Haproxy, Nginx, Apache, and Keepalived exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges by sendi...

9CVSS5.9AI score0.0256EPSS
SaveExploits1References2Affected Software1
NVD
NVD
added 2024/08/29 5:15 p.m.40 views

CVE-2024-43804

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...

8.8CVSS0.0256EPSS
SaveExploits1References1
CVE
CVE
added 2024/08/29 4:45 p.m.71 views

CVE-2024-43804

Roxy-WI suffers an OS Command Injection via its port-scanning feature. Authenticated users can influence the ip value, which is used to build cmd/cmd1, then passed to server_mod.subprocess_execute with shell=True, enabling arbitrary code execution on the web application server. Multiple sources d...

8.8CVSS9AI score0.0256EPSS
SaveExploits1References1Affected Software1
Vulnrichment
Vulnrichment
added 2024/08/29 4:45 p.m.18 views

CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...

8.8CVSS9AI score0.0256EPSS
SaveExploits1References1
OSV
OSV
added 2024/08/29 4:45 p.m.25 views

CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...

8.8CVSS8AI score0.0256EPSS
SaveExploits1References3
Cvelist
Cvelist
added 2024/08/29 4:45 p.m.45 views

CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...

8.8CVSS0.0256EPSS
SaveExploits1References1
Positive Technologies
Positive Technologies
added 2024/08/29 12:0 a.m.8 views

PT-2024-5939 · Roxy-Wi · Roxy-Wi

Name of the Vulnerable Software and Affected Versions: Roxy-WI affected versions not specified Description: The issue is related to an OS Command Injection vulnerability in the Roxy-WI web interface for managing servers. This vulnerability allows any authenticated user to execute arbitrary code o...

9CVSS8AI score0.0256EPSS
SaveExploits1References8
Rows per page
Query Builder