CVE-2020-25132

Observium (Professional, Enterprise & Community) version 20.8.10631 is affected by an SQL injection in includes/authenticate.inc.php via a malformed parameter type Array in the Cookie header, leading to full authentication bypass for any user with application access. The root cause is bypass of c...

CVE-2020-25131

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the rolename or roledescr parameter to the roles/ URI...

CVE-2020-25131

Observium Professional, Enterprise & Community (version 20.8.10631) is vulnerable to Cross-Site Scripting (XSS) via the roles/ URI, caused by injection into role_name or role_descr parameters. The vulnerability allows storing malicious JavaScript code in those fields, enabling script execution in...

CVE-2020-25130

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending an improper variable type of Array allows a bypass of core SQL...

CVE-2020-25130

Observium (Professional/Enterprise/Community) version 20.8.10631 is vulnerable to SQL Injection via the ajax/actions.php group_id field. The issue arises from how certain parameter types (notably an Array) bypass SQL sanitization, enabling authenticated users to inject SQL and potentially perform...

Observium Detection

Observium, a network monitoring tool, is running on the remote host. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid95390; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"; scriptnameenglish:"Observium Detection";...

Observium PHP Object Unserialization Remote File Writing Vulnerability

The remote Observium server is affected by a remote file writing vulnerability in the vardecode function in common.inc.php due to improper validation of user-supplied GET, POST and COOKIE values before use in the PHP unserialize function. An unauthenticated, remote attacker can exploit this to...

Observium Detection

Detection of Observium The script sends a connection request to the server and attempts to detect the presence of Observium and to extract its version SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

Observium Multiple Vulnerabilities

Observium is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:observium:networkmonitor"; if...

Observium Remote Command Execution Vulnerability

During a recent penetration test Computest found and exploited various issues in Observium, going from unauthenticated user to full shell access as root. Summary: Unauthenticated remote command execution as root Affected software: Observium Affected versions: Versions downloaded before 26-10-2016...

Observium 0.16.7533 Code Execution / Cross Site Request Forgery

Exploit title: Observium Commercial - Authenticated RCE Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 28-04-2016 Vendor homepage: http://observium.org/ Software version: CE 0.16.7533 Authenticated remote code execution Using either CSRF or by editing the whois binary field in the...

Observium 0.16.7533 Cross Site Request Forgery

& retype password instead of having to insert the older password. such an attack would look like this: -- Change admin password...

Observium 0.16.7533 - Cross-Site Request Forgery

Exploit for php platform in category web applications & retype password instead of having to insert the older password. such an attack would look like this: -- Change admin password 0day.today 20...

Observium 0.16.7533 - Authenticated Arbitrary Command Execution

Exploit for php platform in category web applications Exploit title: Observium Commercial - Authenticated RCE Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 28-04-2016 Vendor homepage: http://observium.org/ Software version: CE 0.16.7533 Authenticated remote code execution Using eith...

Observium 0.16.7533 - Cross-Site Request Forgery

Observium 0.16.7533 - Cross-Site Request Forgery & retype password instead of having to insert the older password. such an attack would look like this: -- Change admin password...

Observium 0.16.7533 - (Authenticated) Arbitrary Command Execution

Exploit title: Observium Commercial - Authenticated RCE Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 28-04-2016 Vendor homepage: http://observium.org/ Software version: CE 0.16.7533 Authenticated remote code execution Using either CSRF or by editing the whois binary field in the...

Observium 0.16.7533 - Cross-Site Request Forgery

& retype password instead of having to insert the older password. such an attack would look like this: -- Change admin password...

Observium 0.16.7533 - (Authenticated) Arbitrary Command Execution

Observium 0.16.7533 - Authenticated Arbitrary Command Execution Exploit title: Observium Commercial - Authenticated RCE Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 28-04-2016 Vendor homepage: http://observium.org/ Software version: CE 0.16.7533 Authenticated remote code execution...