Vulnerabilities > Rconfig
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-08-20 | CVE-2020-25351 | Files or Directories Accessible to External Parties vulnerability in Rconfig 3.9.5 An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. | 4.0 |
| 2021-08-20 | CVE-2020-25352 | Cross-site Scripting vulnerability in Rconfig 3.9.5 A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. | 3.5 |
| 2021-08-20 | CVE-2020-25353 | Server-Side Request Forgery (SSRF) vulnerability in Rconfig 3.9.5 A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. | 4.0 |
| 2021-08-20 | CVE-2020-25359 | Missing Authorization vulnerability in Rconfig 3.9.5 An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. | 6.4 |
| 2021-08-20 | CVE-2020-27464 | Missing Authorization vulnerability in Rconfig An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted ZIP file. | 6.8 |
| 2021-08-20 | CVE-2020-27466 | Missing Authorization vulnerability in Rconfig 3.9.6 An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code via a crafted file. | 6.8 |
| 2021-08-09 | CVE-2020-23148 | Injection vulnerability in Rconfig 3.9.5 The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request. | 5.0 |
| 2021-08-09 | CVE-2020-23149 | SQL Injection vulnerability in Rconfig 3.9.5 The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database information. | 5.0 |
| 2021-08-09 | CVE-2020-23150 | SQL Injection vulnerability in Rconfig 3.9.5 A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php. | 5.0 |
| 2021-08-09 | CVE-2020-23151 | Command Injection vulnerability in Rconfig 3.9.5 rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function without being escaped. | 7.5 |