Lucene search

Netdata Security Vulnerabilities

cve

CVE-2018-18836

An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.

6.5CVSS

6.8AI Score

0.003EPSS

2019-06-18 04:15 PM

140

cve

CVE-2018-18837

An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.

6.1CVSS

6.7AI Score

0.006EPSS

2019-06-18 04:15 PM

149

cve

CVE-2018-18838

An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter to api/v1/registry.

7.5CVSS

7.3AI Score

0.001EPSS

2019-06-18 04:15 PM

143

cve

CVE-2018-18839

An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via api/v1/alarms. NOTE: the vendor says "is intentional.

5.3CVSS

6AI Score

0.001EPSS

2019-06-18 04:15 PM

147