Show filters
5 Total Results
Displaying 1-5 of 5
Sort by:
Attacker Value
Unknown
CVE-2021-42372
Disclosure Date: November 08, 2021 (last updated February 23, 2025)
A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service.
0
Attacker Value
Unknown
CVE-2021-42370
Disclosure Date: November 08, 2021 (last updated February 23, 2025)
A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in the device properties. (Viewing the passwords requires configuring a web browser to display HTML password input fields.)
0
Attacker Value
Unknown
CVE-2021-42371
Disclosure Date: November 08, 2021 (last updated February 23, 2025)
lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.
0
Attacker Value
Unknown
CVE-2020-24032
Disclosure Date: August 18, 2020 (last updated February 22, 2025)
tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone.
0
Attacker Value
Unknown
CVE-2019-19041
Disclosure Date: June 21, 2019 (last updated November 27, 2024)
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by the underlying system. It is possible to achieve this by modifying the values in the files.SUM file (which are used for integrity control) and injecting malicious code into the upgrade.sh file.
0
