CVE-2024-49369

Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. The TLS certificate validation in all Icinga 2 versions starting from 2.4.0 was flawed, allowing an attacker to impersonate both trusted clust...

CVE-2024-42362

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...

CVE-2024-42361

Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/monitorId/metric/metricFull endpoint to download job metrics. In the process, it executes a SQL query with user-controlled data, allowing for SQL injection...

Sensaphone WEB600 Monitoring System Cross Site Scripting

The Sensaphone WEB600 Monitoring System was found to suffer from multiple persistent cross site scripting vulnerabilities...

The vulnerability of microprogrammed medical device monitoring systems, such as the CMS8000 Patient Monitor and Epsimed MN-120, related to the incorrect provision of information to unauthorized individuals, allows a intruder to gain unauthorized access to protected information and carry out a “man-in-the-middle” type attack.

The vulnerability of the microprogrammed software used in medical devices for monitoring patient status, such as the CMS8000 Patient Monitor and Epsimed MN-120, stems from the unauthorized provision of information to individuals who are not authorized. This occurs due to the use of a rigidly code...

CVE-2024-56144

CVE-2024-56144 / Librenms: A stored XSS in the display parameter of the /device/$DEVICE_ID/edit endpoint affects Librenms up to version 24.11.0. The underlying issue is insufficient input sanitization that allows injected scripts to execute when users view or interact with the affected page. The ...

CVE-2025-23198 Stored-XSS-LibreNMS-Display-Name in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display. Librenms versions up to 24.10.1 allow remote attackers to inject...

CVE-2025-23199

CVE-2025-23199 describes a stored XSS in LibreNMS

CVE-2025-23200

CVE-2025-23200 affects LibreNMS (librenms/librenms) up to version 24.10.1, where a stored XSS is possible via the ajax_form.php parameter state . The root cause is unsanitized user input in the dynamic_override_config path, allowing injected scripts to execute when a page displaying affected data...

CVE-2025-23201

CVE-2025-23201 affects LibreNMS. The issue is a Cross-site Scripting (XSS) in the /addhost endpoint via the community parameter, impacting Librenms versions up to 24.10.1. The root cause is improper handling/escaping of user-supplied input in this parameter, enabling attackers to inject scripts t...

ROS-20241216-06

A vulnerability in the Single sign-on SSO authentication mechanism of the Zabbix universal monitoring system is related to authentication bypass via spoofing. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions and elevate their...

The vulnerability of the WhatsUp Gold network infrastructure monitoring system, related to errors when using privileged application programming interfaces (APIs), allows a hacker to execute arbitrary code.

The vulnerability of the WhatsUp Gold network infrastructure monitoring system is related to errors when privileged application programming interfaces APIs are used. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

ROS-20241216-03

A vulnerability in the Single sign-on SSO authentication mechanism of the Zabbix universal monitoring system is related to authentication bypass via spoofing. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions and elevate their...

ROS-20241216-05

A vulnerability in the Single sign-on SSO authentication mechanism of the Zabbix universal monitoring system is related to authentication bypass via spoofing. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions and elevate their...

ROS-20241212-04

Vulnerability of addRelatedObjects function of Zabbix universal monitoring system is related to failure to take measures to protect SQL query structure. to protect the SQL query structure. Exploitation of the vulnerability could allow an attacker acting remotely to escalate his privileges by...

The vulnerability of the software used in Hitachi Energy’s equipment monitoring and control system, Hitachi Energy MicroSCADA X SYS600, allows a intruder to intercept an already established session.

The vulnerability of the software used in Hitachi Energy’s equipment monitoring and control system, MicroSCADA X SYS600, involves bypassing the authentication process. Exploiting this vulnerability allows a malicious actor to intercept an already established session...

CVE-2024-51495 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "overwriteip" parameter when editing a device. This vulnerability results i...

CVE-2024-49764 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Capture Debug Information" page allows authenticated users to inject arbitrary JavaScript through the "hostname" parameter when creating a new device. This...

CVE-2024-49758

CVE-2024-49758 affects LibreNMS (PHP/MySQL/SNMP). It is a stored XSS vulnerability where an Admin can inject JavaScript into a device’s Notes via the ExamplePlugin, which is triggered when the plugin is enabled. The issue stems from insufficient input sanitization and is mitigated by upgrading to...

CVE-2024-50090

creationtimestamp| type| source ---|---|--- 2024-11-05 17:06:11+00:00| seen| https://infosec.exchange/users/cve/statuses/113431437055534198 2024-11-05 18:53:48+00:00| seen| https://t.me/cvedetector/9902...