CVE-2019-10669

An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqliescaperealstring function. This function is not the appropriate function to sanitize command...

LibreNMS Command Injection Vulnerability

LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A command injection vulnerability exists in the Collectd graphing feature in LibreNMS, which can be exploited by...

LibreNMS Collectd Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in the Collectd graphing functionality in LibreNMS. The to and from parameters used to define the range for a graph are sanitized using the mysqliescaperealstring function, which permits backticks. These parameters are used as part...

Moderate: Red Hat Security Advisory: ovirt-engine-metrics security, bug fix, and enhancement update

An update for ovirt-engine-metrics is now available for Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

LibreNMS Collectd Command Injection

This module exploits a command injection vulnerability in the Collectd graphing functionality in LibreNMS. The to and from parameters used to define the range for a graph are sanitized using the mysqliescaperealstring function, which permits backticks. These parameters are used as part of a shell...

Denial Of Service (DoS)

collectd is vulnerable to denial of service. A double-free vulnerability occurs in the csnmpreadtable function in snmp.c in certain error case, allowing a remote attacker to crash the service...

Denial Of Service (DoS)

collectd is vulnerable to denial of service DoS attacks. The vulnerability exists as an incorrect interaction of the parsepacket and parsepartsignsha256 functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service infinite loop of a collectd instance...

RHEL 7 : collectd (RHSA-2018:2615)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2615 advisory. collectd is a host-based system statistics collection daemon that gathers metrics from various sources periodically, such as the operating...

collectd: Infinite loop due to incorrect interaction of parse_packet() and parse_part_sign_sha256() functions

collectd contains an infinite loop due to how the parsepacket and parsepartsignsha256 functions interact. If an instance of collectd is configured with "SecurityLevel None" and empty "AuthFile" options, an attacker can send crafted UDP packets that trigger the infinite loop, causing a denial of...

collectd: double free in csnmp_read_table function in snmp.c

A double-free vulnerability was found in the csnmpreadtable function in the SNMP plugin of collectd. A network-based attacker could exploit this by sending malformed data, causing collectd to crash or possibly other impact...

Moderate: Red Hat Security Advisory: collectd security update

An update for collectd is now available for Red Hat Gluster Storage 3.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

Moderate: Red Hat Security Advisory: collectd security update

Updated collectd packages are now available for Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

collectd: double free in csnmp_read_table function in snmp.c

A double-free vulnerability was found in the csnmpreadtable function in the SNMP plugin of collectd. A network-based attacker could exploit this by sending malformed data, causing collectd to crash or possibly other impact...

RHEL 7 : collectd (RHSA-2018:0560)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0560 advisory. collectd is a small C-language daemon, which reads various system metrics periodically and updates RRD files creating them if necessary. Because the...

collectd: Multiple vulnerabilities

Background collectd is a daemon which collects system and application performance metrics periodically and provides mechanisms to store the values in a variety of ways, for example in RRD files. Description Multiple vulnerabilities have been found in Gentoo’s collectd package. Please review the...

GLSA-201803-10 : collectd: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201803-10 collectd: Multiple vulnerabilities Multiple vulnerabilities have been found in Gentoos collectd package. Please review the referenced CVE identifiers and bug entries for details. Impact : A local attacker, who either is...

Gentoo app-admin/collectd package local elevation of privilege vulnerability

The Gentoo app-admin/collectd package is a Gentoo Foundation package that collects system statistics and provides stored values. A security vulnerability exists in versions of the Gentoo app-admin/collectd package prior to 5.7.2-r1, which stems from the program assigning ownership of the PID file...

Moderate: Red Hat Security Advisory: collectd security, bug fix, and enhancement update

An update for collectd is now available for RHEV 4.X RHEV-H and Agents for RHEL-7 and RHEV Engine version 4.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

collectd: double free in csnmp_read_table function in snmp.c

A double-free vulnerability was found in the csnmpreadtable function in the SNMP plugin of collectd. A network-based attacker could exploit this by sending malformed data, causing collectd to crash or possibly other impact...

Arbitrary file deletion

The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL when the service is...