CVE-2020-25146: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via laid to the /syslogrules URI for editsyslogrule...

CVE-2020-25133: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files even though...

CVE-2020-25130: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending an improper variable type of Array allows a bypass of core SQL...

CVE-2020-25132: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injecti...

CVE-2020-25142: Cross-Site Request Forgery (CSRF)

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable if any links and forms lack an unpredictable CSRF token. Without such a token, attackers can forge malicious requests, such as for adding Device Settings via the /addsrv URI...

CVE-2020-25140: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur in pages/contacts.inc.php...

CVE-2020-25138: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via /alertcheck/action=deletealertchecker/alerttestid=...

CVE-2020-25143: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via /ajax/deviceentities.php?entitytype=netscalervsvr&devicei...

CVE-2020-25148: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. this can occur via /iftype/type= because of pages/iftype.inc.php...

CVE-2020-25135: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the graphtitle parameter to the graphs/ URI...

PT-2020-15968

Name of the Vulnerable Software and Affected Versions Observium Professional, Enterprise & Community version 20.8.10631 Description An issue in Observium allows SQL Injection due to the possibility of injecting malicious SQL statements through malformed parameter types. Specifically, sending an...

Observium Detection

Observium, a network monitoring tool, is running on the remote host. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid95390; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24"; scriptnameenglish:"Observium Detection";...

Observium PHP Object Unserialization Remote File Writing Vulnerability

The remote Observium server is affected by a remote file writing vulnerability in the vardecode function in common.inc.php due to improper validation of user-supplied GET, POST and COOKIE values before use in the PHP unserialize function. An unauthenticated, remote attacker can exploit this to...

Observium Detection

Detection of Observium The script sends a connection request to the server and attempts to detect the presence of Observium and to extract its version SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...

Observium Multiple Vulnerabilities

Observium is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:observium:networkmonitor"; if...

Observium Remote Command Execution Vulnerability

During a recent penetration test Computest found and exploited various issues in Observium, going from unauthenticated user to full shell access as root. Summary: Unauthenticated remote command execution as root Affected software: Observium Affected versions: Versions downloaded before 26-10-2016...

Observium 0.16.7533 Code Execution / Cross Site Request Forgery

Exploit title: Observium Commercial - Authenticated RCE Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 28-04-2016 Vendor homepage: http://observium.org/ Software version: CE 0.16.7533 Authenticated remote code execution Using either CSRF or by editing the whois binary field in the...

Observium 0.16.7533 Cross Site Request Forgery

& retype password instead of having to insert the older password. such an attack would look like this: -- Change admin password...

Observium 0.16.7533 - Cross-Site Request Forgery

Exploit for php platform in category web applications & retype password instead of having to insert the older password. such an attack would look like this: -- Change admin password 0day.today 20...

Observium 0.16.7533 - Authenticated Arbitrary Command Execution

Exploit for php platform in category web applications Exploit title: Observium Commercial - Authenticated RCE Author: Dolev Farhi Contact: dolevf at protonmail.com Date: 28-04-2016 Vendor homepage: http://observium.org/ Software version: CE 0.16.7533 Authenticated remote code execution Using eith...