GHSA-7F84-28QH-9486 LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Alert Transports" feature allows authenticated users to inject arbitrary JavaScript through the "Details" section which contains multiple fields depending on which transport is selected at that moment. This vulnerability can lead to...

LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Rules" feature

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromisin...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the hostname parameter, in the context of other users' sessions, by injecting...

CVE-2024-47525 Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious...

CVE-2024-47527 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the device name "hostname" parameter. This vulnerability can lead to t...

CVE-2024-47527

Summary (CVE-2024-47527, LibreNMS) A Stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS, affecting the Device Dependencies feature. The flaw allows an authenticated user to inject arbitrary JavaScript via the device hostname parameter, which can execute in other users’ sessions, p...

CVE-2024-47527 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the device name "hostname" parameter. This vulnerability can lead to t...

Use of Cache Containing Sensitive Information

Overview querycommander is a Browser-based SQL Query Tool for Universal Database Management Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information potentially exposing user data across sessions due to improper caching. Remediation Upgrade querycommander ...

Synology DiskStation Manager Use of Insufficiently Random Values (CVE-2018-13280)

Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager DSM before 6.2-23739 allows man-in-the-middle attackers to compromise non- HTTPS sessions via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

LibreNMS 跨站脚本漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A cross-site scripting vulnerability exists in LibreNMS version 24.7.0 and prior version...

CVE-2024-7421

An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions...

PT-2024-27940 · Ibm · Ibm Aspera Shares

Name of the Vulnerable Software and Affected Versions: IBM Aspera Shares versions 1.0 through 1.10.0 PL3 Description: The issue allows an authenticated user to impersonate another user on the system because sessions are not invalidated after a password reset. Recommendations: For IBM Aspera Share...

CVE-2024-43099

The session hijacking attack targets the application layer's control mechanism, which manages authenticated sessions between a host PC and a PLC. During such sessions, a session key is utilized to maintain security. However, if an attacker captures this session key, they can inject traffic into a...

Controller 6000和Controller 7000 安全漏洞

The Gallagher Controller 6000 and Gallagher Controller 7000 are both products of Gallagher New Zealand.The Gallagher Controller 6000 is an interface between a Gallagher Command Center server and distributed field hardware. The Gallagher Controller 7000 is a powerful network connected controller. ...

Relyum RELY-PCIe 安全漏洞

Relyum RELY-PCIe is a smart pluggable board from Relyum Spain. A security vulnerability exists in the Relyum RELY-PCIe versions v22.2.1 through v23.1.0 that stems from not setting the security attributes of sensitive cookies in an HTTPS session, which could result in a user agent sending these...

CVE-2024-45596 Directus's session is cached for OpenID and OAuth2 if `redirect` is not used

Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId...

PT-2024-29882 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.2 SP2 Description: A vulnerability has been identified in the SINEMA Remote Connect Server where the application does not properly handle user session establishment and invalidation. This coul...

Therapy Sessions Exposed by Mental Health Care Firm’s Unsecured Database

Video and audio of therapy sessions, transcripts, and other patient records were accidentally exposed in a publicly accessible database operated by the virtual medical company Confidant Health...

CVE-2023-52887

In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error handling for tightly received RTS messages in xtprxrtssessionnew This patch enhances error handling in scenarios with RTS Request to Send messages arriving closely. It replaces the less informative...

GO-2024-3096 Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server

Mattermost allows remote/synthetic users to create sessions, reset passwords in github.com/mattermost/mattermost-server...