CVE-2018-20434

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...

CVE-2018-20434

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...

CVE-2018-20434

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...

CVE-2018-20434

LibreNMS 1.46 is affected by CVE-2018-20434. The vulnerability allows remote command execution via the POST parameter $_POST['community'] used in html/pages/addhost.inc.php during device creation. A subsequent request to /ajax_output.php?id=capture&format=text&type=snmpwalk&hostname=localhost tri...

CVE-2018-20434 - LibreNMS Addhost Command Injection

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...

PT-2019-10067

Name of the Vulnerable Software and Affected Versions: LibreNMS version 1.46 Description: The issue allows remote attackers to execute arbitrary OS commands. This is achieved by using the community parameter in the html/pages/addhost.inc.php page during the creation of a new device. Then, by maki...

CVE-2018-20434: Improper Neutralization of Special Elements used in an OS Command

LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...

SQL Injection

ilbrenms/librenms is vulnerable to SQL injection. The vulnerability exists as there was insufficient checks on the value of hostname, allowing SQL injection attacks through the sorthostname parameter...

LibreNMS SQL Injection Vulnerability

LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A SQL injection vulnerability exists in the html/ajaxtable.php file in LibreNMS 1.47 and earlier versions. A...

CVE-2018-20678

LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...

Sql injection

LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...

CVE-2018-20678

LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...

CVE-2018-20678

LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...

CVE-2018-20678

CVE-2018-20678 affects LibreNMS (up to 1.47) and describes a SQL injection vulnerability in the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search. The root cause is insufficient validation/parameter handling of hostname sort input, enabling arbitrary...

CVE-2018-20678

LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...

PT-2019-10157

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 1.48 Description: The issue allows SQL injection via the sorthostname parameter in the "html/ajax table.php" endpoint, which can be exploited by authenticated users during a search. Recommendations: For versions pri...

CVE-2018-20678: Improper Neutralization of Special Elements used in an SQL Command

LibreNMS through 1.47 allows SQL injection via the html/ajaxtable.php sorthostname parameter, exploitable by authenticated users during a search...

LibreNMS addhost Command Injection

This module exploits a command injection vulnerability in the open source network management software known as LibreNMS. The community parameter used in a POST request to the addhost functionality is unsanitized. This parameter is later used as part of a shell command that gets passed to the pope...

Cross-Site Scripting (XSS)

LibreNMS is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript and HTML into a victim's browser through the dashboardname parameter in ajaxform.php...

LibreNMS Cross-Site Scripting Vulnerability

LibreNMS is an open source network monitoring system based on PHP and MySQL. The system features customizable alerts , auto-discovery of the network environment and automatic updates . A cross-site scripting vulnerability exists in several files in LibreNMS versions prior to 1.44. A remote attack...