EUVD-2012-6504

Malware in sbrugna...

CVE-2016-6556

OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' or 'sysContact' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This...

CVE-2016-6556: Improper Neutralization of Input During Web Page Generation

OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' or 'sysContact' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This...

PT-2021-8427

Name of the Vulnerable Software and Affected Versions OpenNMS versions prior to 18.0.2 Description The issue is related to a stored XSS problem due to insufficient filtering of SNMP agent supplied data. An attacker can create a malicious SNMP sysName or sysContact response to store an XSS payload...

SNMP – Simply Not My Problem. Or is it?

TL;DR: Use SNMPv3; long gone is default community strings, hello complex passwords! Remove from the internet, if required, implement a VPN solution to restrict access to only authorised parties. SNMP is a protocol used for the remote management of devices on a network. By remote, we mean access...

PT-2015-3694

Name of the Vulnerable Software and Affected Versions Y-Cam camera models SD range versions 4.30 and earlier Y-Cam camera models S range versions 4.30 and earlier Y-Cam EyeBall version 4.30 and earlier Y-Cam Bullet VGA versions 4.30 and earlier Y-Cam Bullet HD 720 version 4.30 and earlier Y-cam...

PT-2014-2421

Name of the Vulnerable Software and Affected Versions SpiceWorks version 5.3.75941 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific configurations in snmpd.conf, including the syslocation, syscontact, or sysName parameters. Recommendations For...

CVE-2012-6658: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the 1 syslocation, 2 syscontact, or 3 sysName configuration in snmpd.conf. NOTE: this entry was SPLIT from CVE-2012-2956 per ADT2 due to different...

PT-2012-4115

Name of the Vulnerable Software and Affected Versions SolarWinds Orion Network Performance Monitor versions prior to 10.3.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via...

CVE-2012-2577: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SolarWinds Orion Network Performance Monitor NPM before 10.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 syslocation, 2 syscontact, or 3 sysName field of an snmpd.conf file...