types Archives

Advisory

LibreNMS 1.65 is affected by an authenticated command-injection vulnerability in the "/about" API endpoint. A "normal" privileges attacker can gain Remote Code Execution (RCE) on the LibreNMS host.

Read more

LibreNMS 1.65 is affected by an authenticated command-injection vulnerability via the HTTP GET "title" parameter in the "/graph.php" API endpoint. A "normal" privileges attacker can gain Remote Code Execution (RCE) on the LibreNMS host.

Read more

LibreNMS 1.65 is affected by a SQL Injection vulnerability via the 'address' parameter in the '/ajax_table.php' API endpoint. A 'normal' privileges attacker can gain access to the database in use by LibreNMS.

Read more

LibreNMS 1.65 is affected by multiple SQL Injection vulnerabilities via the 'searchPhrase' parameter in the '/ajax_table.php' API endpoint. A 'normal' privileges attacker can gain access to the database in use by LibreNMS.

Read more

LibreNMS 1.65 is affected by multiple SQL Injection vulnerabilities via the `sort` parameter in the '/ajax_table.php' API endpoint. A 'normal' privileges attacker can gain access to the database in use by LibreNMS.

Read more

Horde Gollem 3.0.12, as used in Horde Groupware Webmail Edition 5.2.22, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality. An attacker can obtain access to a victim’s webmail account by making them visit a malicious URL.

Read more

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.

Read more

CVE-2019-9202: a Command Injection vulnerability in Nagios Incident Manager (component of Nagios XI) before 2.2.7 allows authenticated attackers to achieve remote code execution via a malicious host record.

Read more

CVE-2019-9204: a SQL Injection vulnerability in Nagios Incident Manager (component of Nagios XI) before 2.2.7 allows authenticated attackers to inject additional SQL statements via the incident_id parameter.

Read more

CVE-2019-9203: An Authorization Bypass vulnerability in Nagios Incident Manager (component of Nagios XI) before 2.2.7 allows unauthenticated users to bypass the authentication checks via a void token.

Read more