Fidelis Cybersecurity

13 results · Feed

• Medium 4.4
  CVE-2022-0486 Public exploit

  Privileged Command Injection Vulnerability in Fidelis Network and Deception

  Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent t…

  Fidelis Cybersecurity Fidelis Deception Fidelis Network
  May 17, 2022
• Low 3.9
  CVE-2022-0997 Public exploit

  Local Privilege Escalation Vulnerability in Fidelis Network and Deception

  Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being ru…

  Fidelis Cybersecurity Fidelis Network Fidelis Deception
  May 17, 2022
• High 8.8
  CVE-2022-24388

  Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulner…

  Fidelis Cybersecurity Fidelis Deception Fidelis Network
  May 17, 2022
• High 8.8
  CVE-2022-24389

  Authenticated Privileged Command Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The …

  Fidelis Cybersecurity Fidelis Network Fidelis Deception
  May 17, 2022
• High 8.8
  CVE-2022-24390

  Authenticated Command Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components…

  Fidelis Cybersecurity Fidelis Deception Fidelis Network
  May 17, 2022
• High 8.8
  CVE-2022-24391

  Authenticated SQL Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in Fidelis Network and Deception CommandPost enables SQL injection through the web interface by an attacker with user level access. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are av…

  Fidelis Cybersecurity Fidelis Network Fidelis Deception
  May 17, 2022
• High 8.8
  CVE-2022-24392

  Authenticated Command Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute s…

  Fidelis Cybersecurity Fidelis Deception Fidelis Network
  May 17, 2022
• High 8.8
  CVE-2022-24393

  Authenticated Command Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade” value for the “cpIp” parameter. The vulnerability could allow a specially crafted HTTP request to ex…

  Fidelis Cybersecurity Fidelis Deception Fidelis Network
  May 17, 2022
• High 8.8
  CVE-2022-24394

  Authenticated Command Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value for the “filename” parameter. The vulnerability could allow a specially crafted HTTP request to exe…

  Fidelis Cybersecurity Fidelis Deception Fidelis Network
  May 17, 2022
• Critical 9.9
  CVE-2021-35049

  Command Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an…

  Fidelis Cybersecurity Fidelis Deception Fidelis Network
  Jun 25, 2021
• Medium 6.5
  CVE-2021-35050

  User Credentials Stored in a Recoverable Format within Fidelis Network and Deception

  User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost, these values could be decoded and used to login to the application. The vulnerability is present i…

  Fidelis Cybersecurity Fidelis Network Fidelis Deception
  Jun 25, 2021
• Critical 9.9
  CVE-2021-35047

  Privileged Command Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is…

  Fidelis Cybersecurity Fidelis Network Fidelis Deception
  Jun 25, 2021
• Critical 9.8
  CVE-2021-35048

  Unauthenticated SQL Injection Vulnerability in Fidelis Network and Deception

  Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in…

  Fidelis Cybersecurity Fidelis Deception Fidelis Network
  Jun 25, 2021