Librenms
Page 2 of 2 — Librenms CVEs from a corpus of 117, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-15877 | High | 8.8 | 2020-07-21 | An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware'… |
CVE-2020-15873 | Medium | 6.5 | 2020-07-21 | In LibreNMS before 1.65.1, an authenticated attacker can achieve SQL Injection via the customoid.inc.php device_id POST parameter to ajax_form.php. |
CVE-2019-12465 | High | 8.1 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in… |
CVE-2019-12464 | High | 7.5 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in… |
CVE-2019-12463 | High | 8.8 | 2019-09-09 | An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.p… |
CVE-2019-10671 | High | 8.8 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An auth… |
CVE-2019-10670 | Medium | 6.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Many of the scripts rely on the function mysqli_escape_real_string for filtering data. However, this is parti… |
CVE-2019-10669 | High | 7.2 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplie… |
CVE-2019-10668 | Critical | 9.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. S… |
CVE-2019-10667 | Medium | 5.3 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose l… |
CVE-2019-10666 | High | 8.1 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. Several of the scripts perform dynamic script inclusion via the include() function on user supplied input wit… |
CVE-2019-10665 | Critical | 9.8 | 2019-09-09 | An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/common.inc.php and html/includes/graphs/gr… |
CVE-2019-15230 | Medium | 5.4 | 2019-08-28 | LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin conso… |
CVE-2018-20434 | Critical | 9.8 | 2019-04-24 | LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation… |
CVE-2018-20678 | High | 8.8 | 2019-03-28 | LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search. |
CVE-2018-18478 | Medium | 6.1 | 2018-10-18 | Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboard_name param… |
CVE-2017-16759 | Medium | 5.9 | 2017-11-09 | The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php. |