GHSA-4M5R-W2RQ-Q54Q LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints

Summary The application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code. Details User with Admin role can edit the Display Name of a device, the application did not properly sanitize the user input i...

CVE-2024-50350 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when creating a new Port Group. This vulnerability results...

CVE-2024-50350

LibreNMS exposes a Stored XSS in Port Settings when creating a Port Group via EditPortsController.php. An authenticated user can inject JavaScript into the name field, which executes when the Port Settings page is revisited after the Port Group is added to a device. Impact includes potential sess...

CVE-2024-50350 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when creating a new Port Group. This vulnerability results...

LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "name" parameter when creating a new Port Group. This vulnerability results in the execution of malicious code when the "Port Settings" page is...

CVE-2024-49759

CVE-2024-49759 describes a Stored XSS in LibreNMS’ Manage User Access flow. An authenticated user could inject arbitrary JavaScript into the bill_name field when creating a new bill, with the script executing in the context of other users when the attacker navigates to the Bill Access UI. The iss...

GHSA-888J-PJQH-FX58 Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "billname" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill...

CVE-2024-49754

LibreNMS (PHP/MySQL/SNMP-based network monitoring) has a Stored XSS vulnerability in the API-Access page. The issue, triggered by the token parameter when creating a new API token, allows an authenticated user to inject JavaScript that runs in other users’ sessions. Impact includes potential acco...

Chatwoot 授权问题漏洞

Chatwoot is a Chatwoot open source application. Customer Engagement Suite, an open source alternative to Intercom, Zendesk, Salesforce Service Cloud, and more. An authorization issue vulnerability exists in versions prior to Chatwoot 2.4.0 that stems from the presence of a session fixation...

Fedora 41 : webkitgtk (2024-4e0b4ce6ad)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-4e0b4ce6ad advisory. Update to WebKitGTK 2.46.3: Flatten layers to a plane when preseve-3d style is set. Fix DuckDuckGo links by adding a user agent quirk. Fix several...

VIWIS LMS 安全漏洞

Viwis LMS is a Learning Management System from Viwis USA. A security vulnerability exists in VIWIS LMS version 9.11 that stems from a missing authorization in the Print Handler component. A user with the Learner role can use the Manage Print function and active sessions to access the entire exam,...

CVE-2024-46892

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 3. The affected application does not properly invalidate sessions when the associated user is deleted or disabled or their permissions are modified. This could allow an authenticated attacker to continue performing...

kernel: smb: client: fix potential UAF in smb2_is_valid_oplock_break()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2isvalidoplockbreak Skip sessions that are being teared down status == SESEXITING to avoid UAF...

SQLite Vulnerable to Out-of-Bounds Memory Access via Insufficient Input Validation in 'sessionReadRecord' Function of 'Sessions' Extension

SQLite is vulnerable to an out-of-bounds memory access issue due to a lack of sufficient input validation in the sessionReadRecord function. An attacker could submit a crafted input in order to trigger the flaw which could allow for a 1-byte out-of-bounds read to occur which could lead to...

Cisco Identity Services Engine Web Interface Cross-Site Scripting Vulnerability (CNVD-2024-45296)

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine WEB interface, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be use...

Cisco Identity Services Engine Web Interface Cross-Site Scripting Vulnerability (CNVD-2024-45297)

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine WEB interface, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be use...

Cisco Identity Services Engine Web Interface Cross-Site Scripting Vulnerability (CNVD-2024-45298)

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in the Cisco Identity Services Engine WEB interface, which can be exploited by a remote attacker to inject malicious script or HTML code, which can be use...

Exploit for CVE-2024-49681

CVE-2024-49681 WP Sessions Time Monitoring Full Automatic...

CVE-2024-51989 Cross-site Scripting (XSS) Vulnerability in PasswordPusher

Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting XSS vulnerability was identified in the PasswordPusher application, affecting versions v1.41.1 through and including v.1.48.0. The issue arises from an un-sanitized parameter...

Cisco Unified Communications Manager 跨站脚本漏洞

Cisco Unified Communications Manager is a call processing component of a Unified Communications system. A cross-site scripting vulnerability exists in the Cisco Unified Communications Manager WEB interface, which can be exploited by remote attackers to inject malicious script or HTML code that ca...