CVE-2023-48294

LibreNMS vulnerability CVE-2023-48294 allows a low-privilege user to enumerate devices by id or hostname via an unauthenticated graph.php request when viewing a device dashboard. The root cause is broken/insufficient access control around the graph endpoint, enabling information disclosure of all...

CVE-2023-48294 Broken Access control on Graphs Feature in LibreNMS

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...

CVE-2023-48295 Cross-site Scripting at Device groups Deletion feature in LibreNMS

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting XSS vulnerability in the device group popups. This issue has been addressed in commit...

CVE-2023-48295

LibreNMS CVE-2023-48295 is an XSS vulnerability in device group popups caused by unsanitized device group names in DeviceGroupController.php (L173). Affected: LibreNMS with vulnerable device-group handling prior to 23.11.0. The issue has been fixed in commit faf66035ea and included in release 23....

CVE-2023-48295 Cross-site Scripting at Device groups Deletion feature in LibreNMS

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting XSS vulnerability in the device group popups. This issue has been addressed in commit...

CVE-2023-48295 Cross-site Scripting at Device groups Deletion feature in LibreNMS

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affected versions are subject to a cross site scripting XSS vulnerability in the device group popups. This issue has been addressed in commit...

LibreNMS Security Vulnerabilities

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments and automatic updates. A security vulnerability exists in LibreNMS versions prior to 23.11.0 that stems from a...

LibreNMS Security Vulnerabilities

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A security vulnerability exists in LibreNMS versions prior to 23.11.0. An attacker...

LibreNMS Security Vulnerabilities

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A security vulnerability exists in LibreNMS versions prior to 23.11.0. An attacker...

PT-2023-30763 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 23.11.0 Description: The issue allows a low-privilege user to enumerate devices on LibreNMS with their id or hostname by accessing a request sent to graph.php when they access their device dashboard. This enables th...

PT-2023-30180 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 23.11.0 Description: The issue concerns the login method in LibreNMS, which lacks a rate limit, allowing an attacker to potentially gain access to user accounts through brute force attacks. The login method uses a G...

SQL Injection

librenms/librenms is vulnerable to SQL Injection. The vulnerability exists because the the search query is not properly sanitized which allows an attacker to extract the whole database...

GHSA-MR6H-7X2M-RGMQ SQL injection in librenms/librenms

SQL Injection in GitHub repository librenms/librenms prior to 23.10.0...

CVE-2023-5591

SQL Injection in GitHub repository librenms/librenms prior to 23.10.0...

Sql injection

SQL Injection in GitHub repository librenms/librenms prior to 23.10.0...

CVE-2023-5591

CVE-2023-5591 describes a SQL injection vulnerability in the open-source monitoring project Libremnms/librenms prior to version 23.10.0. The vulnerability affects the Librenms codebase (Librenms/librenms) and is documented across multiple sources (NVD, Red Hat, OSV, GHSA, CVE lists, and PT Securi...

CVE-2023-5591 SQL Injection in librenms/librenms

SQL Injection in GitHub repository librenms/librenms prior to 23.10.0...

CVE-2023-5591 SQL Injection in librenms/librenms

SQL Injection in GitHub repository librenms/librenms prior to 23.10.0...

LibreNMS SQL Injection Vulnerability

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments and automatic updates. LibreNMS versions prior to 23.10.0 are vulnerable to a SQL injection vulnerability that...

PT-2023-32201 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: librenms versions prior to 23.10.0 Description: The issue is related to SQL Injection in the GitHub repository librenms/librenms. Recommendations: For versions prior to 23.10.0, update to version 23.10.0 or later to resolve the issue...