1264 matches found
CVE-2018-20434
LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...
CVE-2018-20434
LibreNMS 1.46 is affected by CVE-2018-20434. The vulnerability allows remote command execution via the POST parameter $_POST['community'] used in html/pages/addhost.inc.php during device creation. A subsequent request to /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost tri...
CVE-2018-20434 - LibreNMS Addhost Command Injection
LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...
SQL Injection
ilbrenms/librenms is vulnerable to SQL injection. The vulnerability exists as there was insufficient checks on the value of hostname, allowing SQL injection attacks through the sorthostname parameter...
LibreNMS SQL Injection Vulnerability
LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A SQL injection vulnerability exists in the html/ajaxtable.php file in LibreNMS 1.47 and earlier versions. A...
CVE-2018-20678
LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...
CVE-2018-20678
LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...
Sql injection
LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...
CVE-2018-20678
LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...
CVE-2018-20678
CVE-2018-20678 affects LibreNMS (up to 1.47) and describes a SQL injection vulnerability in the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search. The root cause is insufficient validation/parameter handling of hostname sort input, enabling arbitrary...
LibreNMS addhost Command Injection
This module exploits a command injection vulnerability in the open source network management software known as LibreNMS. The community parameter used in a POST request to the addhost functionality is unsanitized. This parameter is later used as part of a shell command that gets passed to the pope...
Cross-Site Scripting (XSS)
LibreNMS is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript and HTML into a victim's browser through the dashboardname parameter in ajaxform.php...
LibreNMS Cross-Site Scripting Vulnerability
LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A cross-site scripting vulnerability exists in several files in LibreNMS versions prior to 1.44. A remote attack...
CVE-2018-18478
Persistent Cross-Site Scripting XSS issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboardname parameter in the /ajaxform.php resource, related to html/includes/forms/add-dashboard.inc.php, html/includes/forms/delete-dashboard.inc.php, and...
CVE-2018-18478
LibreNMS before version 1.44 is vulnerable to a persistent XSS via the dashboard_name parameter in ajax_form.php, related to html/includes/forms/add-dashboard.inc.php, delete-dashboard.inc.php, and edit-dashboard.inc.php. An attacker could inject arbitrary web script/HTML that may be executed in ...
CVE-2018-18478
Persistent Cross-Site Scripting XSS issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboardname parameter in the /ajaxform.php resource, related to html/includes/forms/add-dashboard.inc.php, html/includes/forms/delete-dashboard.inc.php, and...
Unauthorized Arbitrary File Read
librenms is vulnerable to unauthorized arbitrary file reads. The attack is only possible during the installation process where authentication can be bypassed and arbitrary files related to html/install.php become readable...
LibreNMS Arbitrary File Read Vulnerability
LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A security vulnerability exists in the installation process in versions of LibreNMS prior to 2017-08-18. A remot...