Improper Authorization in librenms/librenms

Description LibreNMS v22.1.0 allows users with the normal role/level to interact with the plugin setting resulting in the users could take action such as switching on/off any installed plugins which are supposedly accessible by the Administrator only. Proof of Concept Affected endpoints: 1 GET...

Exposure of Sensitive Information to an Unauthorized Actor in librenms/librenms

LibreNMS v22.1.0 allows users with the normal role/level to view/access the alert transport details. The alert transport may expose sensitive information to an actor that is not explicitly authorized to have access to that information which are supposedly accessible by the Administrator only. Pro...

Improper Access Control in librenms/librenms

Description Improper Access Control vulnerability in LibreNMS v22.1.0 allows attackers with the normal role/level to interact with port-groups functionality such as create, edit/modify and delete the existing port group. The port-groups functionality fails to enforce policy such that normal users...

Cross-site Scripting (XSS) - Generic in librenms/librenms

Description Cross-Site Scripting vulnerability in LibreNMS v22.1.0 which allows attackers to execute arbitrary javascript code which affected Alerts module Alert Transport in Transport name field. Proof of Concept Endpoint: 1 POST http://HOST/ajaxform.php - Parameter name Payload: ' XSS will...

Cross-site Scripting (XSS) - Stored in librenms/librenms

Description Cross-Site Scripting vulnerability in LibreNMS v22.1.0 which allows attackers to execute arbitrary javascript code in the browser of a victim which affected Devices module Add Device in sysName, Hardware and Community fields. Proof of Concept Endpoint: 1 POST http://HOST/addhost...

Path traversal in librenms/librenms

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php...

GHSA-7289-CHWJ-7H86 Path traversal in librenms/librenms

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php...

Librenms path traversal vulnerability

Librenms is a Librenms community of open source network monitoring system based on PHP and MySQL. The system features custom alerts, automatic discovery of network environments and automatic updates.Librenms suffers from a path traversal vulnerability that stems from Librenms 21.11.0 being affect...

Path Traversal

librenms/librenms is vulnerable to path traversal. The library does not properly encode the $currentconfig attribute in showconfig.inc.php, allowing an attacker to access files outside the expected directory through the $url field...

GHSA-5VR6-HM68-5J9P Cross-site Scripting in LibreNMS

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting XSS vulnerability in includes/html/forms/poller-groups.inc.php...

Cross-site Scripting in LibreNMS

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting XSS vulnerability in includes/html/forms/poller-groups.inc.php...

GHSA-4GWH-2PQX-F5CC Cross-site Scripting in LibreNMS

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting XSS vulnerability in includes/html/common/alert-log.inc.php...

Cross-site Scripting in LibreNMS

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting XSS vulnerability in includes/html/common/alert-log.inc.php...

CVE-2021-44278

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php...

CVE-2021-44278

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php...

Path traversal

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php...

CVE-2021-44278

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php...

CVE-2021-44278

Librenms 21.11.0 is affected by a path traversal vulnerability in includes/html/pages/device/showconfig.inc.php, enabling manipulation of the requested path to access files outside the intended directory. Multiple connected advisories (GHSA-7289-CHWJ-7H86, OSV:GHSA-7289-CHWJ-7H86, CNVD/CNNVD, Ver...

Librenms 路径遍历漏洞

Librenms is a Librenms community of open source network monitoring system based on PHP and MySQL. The system features custom alerts, automatic discovery of network environments and automatic updates.Librenms suffers from a path traversal vulnerability that stems from Librenms 21.11.0 being affect...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to lack of HTML escaping in poller-groups.inc.php which allows a malicious attacker to inject and execute arbitrary javascript...