CVE-2022-4069 Cross-site Scripting (XSS) - Generic in librenms/librenms

Cross-site Scripting XSS - Generic in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3525 Deserialization of Untrusted Data in librenms/librenms

Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3516 Cross-site Scripting (XSS) - Stored in librenms/librenms

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3561 Cross-site Scripting (XSS) - Generic in librenms/librenms

Cross-site Scripting XSS - Generic in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3562 Cross-site Scripting (XSS) - Stored in librenms/librenms

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-4070 Insufficient Session Expiration in librenms/librenms

Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3561

CVE-2022-3561 is a Cross-site Scripting (XSS) vulnerability affecting LibreNMS (librenms/librenms) prior to version 22.10.0. The issue is described as a generic XSS vulnerability in the Librenms codebase (no vendor-specific details beyond the Librenms repository). Affected versions are prior to 2...

CVE-2022-3562

CVE-2022-3562 is a stored XSS in LibreNMS (librenms/librenms) prior to 22.10.0. Veracode notes the issue due to lack of sanitization in bill_name in print_port_list (bill.inc.php), allowing malicious JavaScript. Multiple sources confirm XSS exists before 22.10.0; remediation is to upgrade to 22.1...

CVE-2022-4069

CVE-2022-4069 affects librenms/librenms prior to 22.10.0. The vulnerability is a Cross-site Scripting (XSS) flaw arising from insufficient input validation in web UI components, notably in destroy-related code paths (e.g., DeviceGroupController.php and PortGroupController.php) that process pop-up...

CVE-2022-3516

CVE-2022-3516 affects LibreNMS installations with versions prior to 22.10.0. The issue is a stored Cross-site Scripting (XSS) vulnerability in the project’s web-facing components, allowing an attacker to inject and persist malicious script that can execute in an authenticated user’s browser after...

CVE-2022-3525

CVE-2022-3525 describes a vulnerability in the LibreNMS project (librenms/librenms) before version 22.10.0, caused by deserialization of untrusted data. The Red Hat, CNVD, CNNVD, GHSA, OSV, NVD, and CVE listings confirm this issue across multiple ecosystems, with the core impact described as seve...

CVE-2022-4067

LibreNMS (librenms/librenms) is affected by a stored Cross-site Scripting (XSS) vulnerability in versions prior to 22.10.0. Root cause cited in sources is stored XSS; impact is consistent with XSS in the web UI. Remediation: upgrade to version 22.10.0 or later to resolve the issue. Public referen...

CVE-2022-4070

LibreNMS (librenms/librenms) is affected by CVE-2022-4070: Insufficient session expiration prior to version 22.10.0. The vulnerability stems from inadequate session expiration handling in LibreNMS before 22.10.0 and is documented across multiple sources (including Red Hat, GHSA, CNVD, NVD, OSV). ...

HTML injection possible via LLDP

Description An unmanaged/foreign neighbouring device that is advertising its presence with LLDP can inject malicious HTML code into LibreNMS by setting its System Name TLV to whatever snippet is to be injected. This is assuming that a device that is managed by LibreNMS has LLDP and the...

Unauthenticated, Stored XSS to RCE via SNMP Trap

Description LibreNMS offers the ability to handle SNMP traps as documented here. One of the SNMP trap handlers called HPFault creates an event with the message "Fault - Unhandled ..." when receiving a trap with an unknown type. The type of this event is set to the received, unknown type, which is...

Deserialization of arbitrary data leads to RCE

Description LibreNMS includes support for monitoring applications, one of which is memcached. When polling for memcached, the data returned by the agent to the LibreNMS server is not verified before it is deserialized. Because LibreNMS has quite a few dependencies, it is easy to find a working...

LibreNMS Cross-Site Scripting Vulnerability (CNVD-2022-81242)

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A cross-site scripting vulnerability exists in LibreNMS versions prior to 22.9.0. An...

Cross-site Scripting (XSS)

librenms/librenms is vulnerable to stored cross-site scriptingXSS attacks. The library does not properly escape user inputs inserted through the title parameter in formatItem function, allowing an authenticated attacker to inject and execute malicious javascript on victim's browser...

LibreNMS stored Cross-site Scripting via Schedule Maintenance `Title` parameter

LibreNMS versions 22.8.0 and prior allow attackers to execute arbitrary JavaScript code via the Schedule Maintenance Title parameter. A patch is available and anticipated to be part of version 22.9.0...

GHSA-3JH2-WMV7-M932 LibreNMS stored Cross-site Scripting via Schedule Maintenance `Title` parameter

LibreNMS versions 22.8.0 and prior allow attackers to execute arbitrary JavaScript code via the Schedule Maintenance Title parameter. A patch is available and anticipated to be part of version 22.9.0...