CVE-2022-4067

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-4070

Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-0575

Cross-site Scripting XSS - Stored in Packagist librenms/librenms prior to 22.2.0...

CVE-2022-0576

Cross-site Scripting XSS - Generic in Packagist librenms/librenms prior to 22.1.0...

CVE-2022-36745

LibreNMS v22.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the component print-customoid.php...

CVE-2022-36746

LibreNMS v22.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the component oxidized-cfg-check.inc.php...

CVE-2022-3562

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3516

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-3231

Cross-site Scripting XSS - Stored in GitHub repository librenms/librenms prior to 22.9.0...

CVE-2022-29712

LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the serviceip, hostname, and serviceparam parameters...

CVE-2022-3561

Cross-site Scripting XSS - Generic in GitHub repository librenms/librenms prior to 22.10.0...

CVE-2022-29711

LibreNMS v22.3.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /Table/GraylogController.php...

CVE-2021-43324

LibreNMS through 21.10.2 allows XSS via a widget title...

CVE-2020-35700

A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...

CVE-2020-15873

In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php deviceid POST parameter to ajaxform.php...

CVE-2019-10665

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...

CVE-2019-10670

An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqliescaperealstring for filtering data. However, this is particularly ineffective when returning user supplied input in an HTML or a JavaScript context, resulting in unsafe data being injected into these...

CVE-2019-10667

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths...

CVE-2019-10671

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter...

CVE-2019-10668

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly...