1238 matches found
CVE-2022-0575
CVE-2022-0575 corresponds to a stored Cross-site Scripting (XSS) vulnerability in the Librenms project, affecting librenms/librenms prior to version 22.2.0. The available documents consistently state that the issue is a stored XSS in Librenms, without detailing exact exploit vectors, affected mod...
CVE-2022-0575 Cross-site Scripting (XSS) - Stored in librenms/librenms
Cross-site Scripting XSS - Stored in Packagist librenms/librenms prior to 22.2.0...
CVE-2022-0575 Cross-site Scripting (XSS) - Stored in librenms/librenms
Cross-site Scripting XSS - Stored in Packagist librenms/librenms prior to 22.2.0...
CVE-2022-0576 Cross-site Scripting (XSS) - Generic in librenms/librenms
Cross-site Scripting XSS - Generic in Packagist librenms/librenms prior to 22.1.0...
CVE-2022-0576
CVE-2022-0576 affects librenms/librenms (prior to 22.1.0) with a Cross-site Scripting (XSS) vulnerability arising from insufficient sanitization in the Transport name field in alert-transports.inc.php. The vulnerability is described in connected sources as a generic XSS in the Librenms package, w...
CVE-2022-0576 Cross-site Scripting (XSS) - Generic in librenms/librenms
Cross-site Scripting XSS - Generic in Packagist librenms/librenms prior to 22.1.0...
Cross-site Scripting (XSS) - Stored in librenms/librenms
Description Stored XSS in create/modify Transport Groups, Add/Edit Service and Edit Service Template Proof of Concept Payload: ' PoC image: Xss payload in create/modify Transport Groups Xss payload in Add/Edit Service Xss payload in Edit Service Template XSS will fire-up by user visiting: 1...
Improper Authorization in librenms/librenms
Description LibreNMS v22.1.0 allows users with the normal role/level to interact with the plugin setting resulting in the users could take action such as switching on/off any installed plugins which are supposedly accessible by the Administrator only. Proof of Concept Affected endpoints: 1 GET...
Exposure of Sensitive Information to an Unauthorized Actor in librenms/librenms
LibreNMS v22.1.0 allows users with the normal role/level to view/access the alert transport details. The alert transport may expose sensitive information to an actor that is not explicitly authorized to have access to that information which are supposedly accessible by the Administrator only. Pro...
Improper Access Control in librenms/librenms
Description Improper Access Control vulnerability in LibreNMS v22.1.0 allows attackers with the normal role/level to interact with port-groups functionality such as create, edit/modify and delete the existing port group. The port-groups functionality fails to enforce policy such that normal users...
Cross-site Scripting (XSS) - Generic in librenms/librenms
Description Cross-Site Scripting vulnerability in LibreNMS v22.1.0 which allows attackers to execute arbitrary javascript code which affected Alerts module Alert Transport in Transport name field. Proof of Concept Endpoint: 1 POST http://HOST/ajaxform.php - Parameter name Payload: ' XSS will...
Cross-site Scripting (XSS) - Stored in librenms/librenms
Description Cross-Site Scripting vulnerability in LibreNMS v22.1.0 which allows attackers to execute arbitrary javascript code in the browser of a victim which affected Devices module Add Device in sysName, Hardware and Community fields. Proof of Concept Endpoint: 1 POST http://HOST/addhost...
Path traversal in librenms/librenms
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php...
GHSA-7289-CHWJ-7H86 Path traversal in librenms/librenms
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php...
Librenms path traversal vulnerability
Librenms is a Librenms community of open source network monitoring system based on PHP and MySQL. The system features custom alerts, automatic discovery of network environments and automatic updates.Librenms suffers from a path traversal vulnerability that stems from Librenms 21.11.0 being affect...
Path Traversal
librenms/librenms is vulnerable to path traversal. The library does not properly encode the $currentconfig attribute in showconfig.inc.php, allowing an attacker to access files outside the expected directory through the $url field...
Cross-site Scripting in LibreNMS
LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting XSS vulnerability in includes/html/forms/poller-groups.inc.php...
GHSA-5VR6-HM68-5J9P Cross-site Scripting in LibreNMS
LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting XSS vulnerability in includes/html/forms/poller-groups.inc.php...