CVE-2018-12973

An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI...

Input validation

An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...

CVE-2018-12973

An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI...

CVE-2018-12973

OpenTSDB 2.3.0 is affected by a Cross-site Scripting (XSS) vulnerability in the json parameter of the /q URI. The issue, described across multiple sources (OpenTSDB advisories and CVE references), indicates that unsanitary input in the json parameter can lead to script injection. The available co...

CVE-2018-12973

An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI...

CVE-2018-12972

OpenTSDB 2.3.0 is affected by CVE-2018-12972. The /q endpoint accepts many parameters (o, key, style, yrange, y2range, and their JSON input) that can be used to execute arbitrary commands, enabling remote code execution. Public advisories (GHSA-CX2V-JRJC-G54W and OSV/Veracode entries) describe th...

CVE-2018-12972

An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input...

OpenTSDB Cross-Site Scripting Vulnerability

OpenTSDB is a set of open source, scalable distributed time series database. A cross-site scripting vulnerability exists in OpenTSDB version 2.3.0. A remote attacker can exploit this vulnerability by sending a 'json' parameter to the /q URI to inject arbitrary web script or HTML...

PT-2018-11532 · Opentsdb · Opentsdb

Name of the Vulnerable Software and Affected Versions: OpenTSDB version 2.3.0 Description: An issue was discovered in OpenTSDB, where there is a Cross-Site Scripting XSS vulnerability in the type parameter to the "/suggest" URI. This allows for potential malicious script execution. Recommendation...

OpenTSDB Remote Command Execution Vulnerability

OpenTSDB is a set of open source, scalable distributed time series database. A remote command execution vulnerability exists in OpenTSDB version 2.3.0. An attacker can exploit this vulnerability by sending multiple parameters e.g., o, key, style, yrange, or y2range to the /q URI to execute comman...

Real Time Performance Monitoring: netdata

Real Time Performance Monitoring Netdata is a daemon that collects data in realtime per second and presents a web site to view and analyze them. The presentation is also real-time and full of interactive charts that precisely render all collected values. netdata is the fastest way to visualize...

OpenTSDB Remote Code Execution

The paramenter wxh needs some sanitation before being used by opentsdb. See example url: http://opentsdb.com:4242/q?start=2016/04/13-10:21:00&ignore=2&m=sum:jmxdata.cpu&o=&yrange=0:&key=out%20right%20top&wxh=1900x770%60id%60&style=linespoint&png Results in RCE unfortunately More parameters: wxh...