Filtered by vendor Librenms
Subscribe
Total
55 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-3525 | 1 Librenms | 1 Librenms | 2022-11-21 | N/A | 8.8 HIGH |
| Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0. | |||||
| CVE-2022-3516 | 1 Librenms | 1 Librenms | 2022-11-21 | N/A | 6.1 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. | |||||
| CVE-2022-3231 | 1 Librenms | 1 Librenms | 2022-09-21 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0. | |||||
| CVE-2022-36746 | 1 Librenms | 1 Librenms | 2022-09-01 | N/A | 6.1 MEDIUM |
| LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component oxidized-cfg-check.inc.php. | |||||
| CVE-2022-36745 | 1 Librenms | 1 Librenms | 2022-09-01 | N/A | 6.1 MEDIUM |
| LibreNMS v22.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component print-customoid.php. | |||||
| CVE-2022-29711 | 1 Librenms | 1 Librenms | 2022-06-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogController.php. | |||||
| CVE-2022-29712 | 1 Librenms | 1 Librenms | 2022-06-09 | 7.5 HIGH | 9.8 CRITICAL |
| LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters. | |||||
| CVE-2022-0772 | 1 Librenms | 1 Librenms | 2022-03-07 | 3.5 LOW | 4.8 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2. | |||||
| CVE-2022-0576 | 1 Librenms | 1 Librenms | 2022-02-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0. | |||||
| CVE-2022-0575 | 1 Librenms | 1 Librenms | 2022-02-23 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0. | |||||
| CVE-2022-0587 | 1 Librenms | 1 Librenms | 2022-02-22 | 4.0 MEDIUM | 6.5 MEDIUM |
| Improper Authorization in Packagist librenms/librenms prior to 22.2.0. | |||||
| CVE-2022-0589 | 1 Librenms | 1 Librenms | 2022-02-22 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0. | |||||
| CVE-2021-44278 | 1 Librenms | 1 Librenms | 2021-12-06 | 7.5 HIGH | 9.8 CRITICAL |
| Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. | |||||
| CVE-2021-44279 | 1 Librenms | 1 Librenms | 2021-12-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php. | |||||
| CVE-2021-44277 | 1 Librenms | 1 Librenms | 2021-12-03 | 4.3 MEDIUM | 6.1 MEDIUM |
| Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php. | |||||
| CVE-2021-43324 | 1 Librenms | 1 Librenms | 2021-11-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| LibreNMS through 21.10.2 allows XSS via a widget title. | |||||
| CVE-2021-31274 | 1 Librenms | 1 Librenms | 2021-09-15 | 3.5 LOW | 5.4 MEDIUM |
| In LibreNMS < 21.3.0, a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result, arbitrary Javascript code can get executed. | |||||
| CVE-2019-10666 | 1 Librenms | 1 Librenms | 2021-07-21 | 6.8 MEDIUM | 8.1 HIGH |
| An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input without sanitizing the values by calling basename() or a similar function. An attacker can leverage this to execute PHP code from the included file. Exploitation of these scripts is made difficult by additional text being appended (typically .inc.php), which means an attacker would need to be able to control both a filename and its content on the server. However, exploitation can be achieved as demonstrated by the csv.php?report=../ substring. | |||||
| CVE-2020-15877 | 1 Librenms | 1 Librenms | 2021-07-21 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php. | |||||
| CVE-2020-35700 | 1 Librenms | 1 Librenms | 2021-02-09 | 6.5 MEDIUM | 8.8 HIGH |
| A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sort_order parameter against the /ajax/form/widget-settings endpoint. | |||||