Browse CVEs

HIGH 8.8 CVE-2023-39108 rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/compareClas… Rconfig No fix yet Fix from $1,9502023-08-01 HIGH 8.8 CVE-2023-39109 rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/compareClas… Rconfig No fix yet Fix from $1,9502023-08-01 HIGH 8.8 CVE-2023-39110 rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. This vulnerability al… Rconfig No fix yet Fix from $1,9502023-08-01 HIGH 8.8 CVE-2022-45030 A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-pr… Rconfig No fix yet Fix from $1,9502023-04-15 MEDIUM 6.5 CVE-2023-24366 An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request. Rconfig Mitigation only Fix from $1,6002023-03-27 HIGH 8.8 CVE-2022-44384EPSS 5% An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file. Rconfig No fix yet Fix from $1,9502022-11-17 HIGH 8.8 CVE-2021-29005 Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password … Rconfig Mitigation only Fix from $1,9502021-10-11 MEDIUM 6.5 CVE-2021-29006EPSS 6% rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server. Rconfig No fix yet Fix from $1,6002021-10-11 HIGH 8.8 CVE-2021-29004 rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not s… Rconfig Mitigation only Fix from $1,9502021-10-11 CRITICAL 9.1 CVE-2020-25359 An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted r… Rconfig No fix yet Fix from $2,3002021-08-20 HIGH 7.8 CVE-2020-27466 An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a craf… Rconfig Mitigation only Fix from $1,9502021-08-20 MEDIUM 6.5 CVE-2020-25351 An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers … Rconfig No fix yet Fix from $1,6002021-08-20 MEDIUM 6.5 CVE-2020-25353 A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attacke… Rconfig No fix yet Fix from $1,6002021-08-20 MEDIUM 5.4 CVE-2020-25352 A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability a… Rconfig No fix yet Fix from $1,6002021-08-20 CRITICAL 9.8 CVE-2020-23151EPSS 6% rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed d… Rconfig No fix yet Fix from $2,3002021-08-09 HIGH 7.5 CVE-2020-23148 The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive inform… Rconfig No fix yet Fix from $1,9502021-08-09 HIGH 7.5 CVE-2020-23149 The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive databas… Rconfig No fix yet Fix from $1,9502021-08-09 HIGH 7.5 CVE-2020-23150 A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request … Rconfig No fix yet Fix from $1,9502021-08-09 CRITICAL 9.9 CVE-2020-15715 rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script.… Rconfig Mitigation only Fix from $2,3002020-07-28 HIGH 8.8 CVE-2020-15713 rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script using the s… Rconfig Mitigation only Fix from $1,9502020-07-28 HIGH 8.8 CVE-2020-15714 rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using … Rconfig Mitigation only Fix from $1,9502020-07-28 HIGH 8.8 CVE-2020-12255EPSS 53% rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file uplo… Rconfig Mitigation only Fix from $1,9502020-05-18 MEDIUM 5.4 CVE-2020-12256EPSS 96% rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbi… Rconfig No fix yet Fix from $1,6002020-05-18 CRITICAL 9.1 CVE-2020-12258 rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPS… Rconfig Mitigation only Fix from $2,3002020-05-18 HIGH 8.8 CVE-2020-12257 rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token. An attacker… Rconfig No fix yet Fix from $1,9502020-05-18 MEDIUM 5.4 CVE-2020-12259EPSS 96% rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability b… Rconfig Mitigation only Fix from $1,6002020-05-18 HIGH 8.8 CVE-2019-19509EPSS 72% An issue was discovered in rConfig 3.9.3. A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFil… Rconfig No fix yet Fix from $1,9502020-01-06 HIGH 7.8 CVE-2019-19585EPSS 6% An issue was discovered in rConfig 3.9.3. The install script updates the /etc/sudoers file for rconfig specific tasks. After an "rConfig specific Apa… Rconfig No fix yet Fix from $1,9502020-01-06 HIGH 8.8 CVE-2019-19207EPSS 23% rConfig 3.9.2 allows devices.php?searchColumn= SQL injection. Rconfig No fix yet Fix from $1,9502019-11-21 CRITICAL 9.8 CVE-2019-16662EPSS 98% An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php beca… Rconfig No fix yet Fix from $2,3002019-10-28