CVE-2020-15877: Undefined Security Weakness

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' = 'admin'" instead of "'middleware' = 'can:admin'" in routes/web.php...

PT-2020-14679

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.65.1 Description The issue allows an authenticated attacker to achieve SQL Injection. This is possible via the device id POST parameter to the "ajax form.php" endpoint. Recommendations For versions prior to 1.65.1,...

CVE-2020-15873: Improper Neutralization of Special Elements used in an SQL Command

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php deviceid POST parameter to ajaxform.php...

LibreNMS 1.46 - (search) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: LibreNMS 1.46 - 'search' SQL Injection Google Dork:unknown Exploit Author: Punt Vendor Homepage: https://www.librenms.org Software Link: https://www.librenms.org Version:1.46 and less Tested on:Linux and Windows CVE: N/A Affecte...

LibreNMS 1.46 SQL Injection

Exploit Title: LibreNMS 1.46 - 'search' SQL Injection Google Dork:unknown Date: 2019-09-01 Exploit Author: Punt Vendor Homepage: https://www.librenms.org Software Link: https://www.librenms.org Version:1.46 and less Tested on:Linux and Windows CVE: N/A Affected Device: more than 4k found on Shoda...

LibreNMS 1.46 - 'search' SQL Injection

Exploit Title: LibreNMS 1.46 - 'search' SQL Injection Google Dork:unknown Date: 2019-09-01 Exploit Author: Punt Vendor Homepage: https://www.librenms.org Software Link: https://www.librenms.org Version:1.46 and less Tested on:Linux and Windows CVE: N/A Affected Device: more than 4k found on Shoda...

PT-2020-12272

Name of the Vulnerable Software and Affected Versions Docker Desktop Enterprise versions prior to 2.1.0.9 Docker Desktop for Windows Stable versions prior to 2.2.0.4 Docker Desktop for Windows Edge versions prior to 2.2.2.0 LibreNMS versions prior to 1.48 Description The issue allows for local...

SQL Injection in LibreNMS

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

GHSA-G9XH-3W5G-229R SQL Injection in LibreNMS

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

SQL Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajaxrulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajaxrulesuggest.php?debug=1&term= request...

GHSA-878X-85HC-GC4G SQL Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajaxrulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajaxrulesuggest.php?debug=1&term= request...

Path Traversal in LibreNMS

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution...

GHSA-R336-JXFR-4C3C Path Traversal in LibreNMS

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution...

Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...

GHSA-F4HH-XXQH-WGPQ Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...

Improper Encoding or Escaping of Output and Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

GHSA-W5R2-GVGF-MPM8 Improper Encoding or Escaping of Output and Injection in LibreNMS

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqlirealescapestring,...

GHSA-277V-GWFR-HMPJ Missing Authentication for Critical Function in LibreNMS

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly...

Missing Authentication for Critical Function in LibreNMS

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly...

Directory Traversal

librenms/librenms is vulnerable to directory traversal. The usage of mysqlrealescapestring to sanitize untrusted user supplied data that is subsequently passed to the include function as a file path in csv.php, is insecure. An attacker could potentially include arbitrary files on the server using...