Lucene search

K

Netdata Security Vulnerabilities

cve
cve

CVE-2019-9834

The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to...

6.1CVSS

6.4AI Score

0.018EPSS

2019-03-15 05:29 PM
54
cve
cve

CVE-2018-18839

An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via api/v1/alarms. NOTE: the vendor says "is...

5.3CVSS

6AI Score

0.001EPSS

2019-06-18 04:15 PM
145
cve
cve

CVE-2024-32019

Netdata is an open source observability tool. In affected versions the ndsudo tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The ndsudo tool is packaged as a root-owned executable with the SUID bit set. It only runs a...

8.8CVSS

8.5AI Score

0.0004EPSS

2024-04-12 09:15 PM
23
cve
cve

CVE-2023-22497

Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. It is generated when the agent first starts and it is saved to disk, so that it will persist across restarts and reboots. Anyone who has...

9.1CVSS

9AI Score

0.001EPSS

2023-01-14 02:15 AM
33
cve
cve

CVE-2023-22496

Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function health_alarm_execute is called. This....

9.8CVSS

9.9AI Score

0.002EPSS

2023-01-14 01:15 AM
23
cve
cve

CVE-2018-18836

An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client_api_request_v1_data in...

6.5CVSS

6.8AI Score

0.003EPSS

2019-06-18 04:15 PM
137
2
cve
cve

CVE-2018-18838

An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter to...

7.5CVSS

7.3AI Score

0.001EPSS

2019-06-18 04:15 PM
138
2
cve
cve

CVE-2018-18837

An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in...

6.1CVSS

6.7AI Score

0.006EPSS

2019-06-18 04:15 PM
143
2