Rapid7
Page 2 of 2 — Rapid7 CVEs from a corpus of 131, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7377 | High | 8.1 | 2020-08-24 | The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar meth… |
CVE-2020-7376 | High | 7.1 | 2020-08-24 | The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can… |
CVE-2020-7355 | Medium | 6.1 | 2020-06-25 | Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted n… |
CVE-2020-7354 | Medium | 6.1 | 2020-06-25 | Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted ne… |
CVE-2020-7350 | Medium | 6.1 | 2020-04-22 | Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted use… |
CVE-2012-6494 | Medium | 6.1 | 2020-01-25 | Rapid7 Nexpose before 5.5.4 contains a session hijacking vulnerability which allows remote attackers to capture a user's session and gain unauthorized access. |
CVE-2019-5647 | Medium | 4.4 | 2020-01-22 | The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after a restart of the Chrome browser. This b… |
CVE-2019-5642 | Low | 3.3 | 2019-11-06 | Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system duri… |
CVE-2019-5638 | High | 8.7 | 2019-08-21 | Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, lo… |
CVE-2019-5631 | High | 7.8 | 2019-08-19 | The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the sys… |
CVE-2019-5629 | High | 7.8 | 2019-07-13 | Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Age… |
CVE-2019-5630 | Medium | 5.9 | 2019-07-03 | A Cross-Site Request Forgery (CSRF) vulnerability was found in Rapid7 Nexpose InsightVM Security Console versions 6.5.0 through 6.5.68. This issue allows attac… |
CVE-2019-5624 | High | 7.3 | 2019-04-30 | Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip impor… |
CVE-2019-5615 | Medium | 6.5 | 2019-04-09 | Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwor… |
CVE-2018-5559 | Low | 3.4 | 2018-11-28 | In Rapid7 Komand version 0.41.0 and prior, certain endpoints that are able to list the always encrypted-at-rest connection data could return some configuration… |
CVE-2017-5264 | High | 8.8 | 2017-12-14 | Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application… |
CVE-2017-15084 | Medium | 6.5 | 2017-10-06 | The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. |
CVE-2017-5244 | Low | 3.5 | 2017-06-15 | Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the st… |
CVE-2017-5243 | High | 8.5 | 2017-06-06 | The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other imp… |
CVE-2017-5240 | High | 7.5 | 2017-05-03 | Editions of Rapid7 AppSpider Pro prior to version 6.14.060 contain a heap-based buffer overflow in the FLAnalyzer.exe component. A malicious or malformed Flash… |
CVE-2017-5236 | High | 7.8 | 2017-05-03 | Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the installer to load… |
CVE-2017-5235 | High | 7.8 | 2017-03-02 | Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a… |
CVE-2017-5234 | High | 7.8 | 2017-03-02 | Rapid7 Insight Collector installers prior to version 1.0.16 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a maliciou… |
CVE-2017-5233 | High | 7.8 | 2017-03-02 | Rapid7 AppSpider Pro installers prior to version 6.14.053 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious… |
CVE-2017-5232 | High | 7.8 | 2017-03-02 | All editions of Rapid7 Nexpose installers prior to version 6.4.24 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a ma… |
CVE-2017-5231 | High | 7.1 | 2017-03-02 | All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cm… |
CVE-2017-5230 | High | 7.2 | 2017-03-02 | The Java keystore in all versions and editions of Rapid7 Nexpose prior to 6.4.50 is encrypted with a static password of 'r@p1d7k3y5t0r3' which is not modifiabl… |
CVE-2017-5229 | High | 7.1 | 2017-03-02 | All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump… |
CVE-2017-5228 | High | 7.1 | 2017-03-02 | All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() funct… |
CVE-2016-9757 | Medium | 5.4 | 2016-12-20 | In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags can inject cross-site… |
CVE-2012-6493 | | 2014-02-04 | Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspeci… |