CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47523 – LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature
https://notcve.org/view.php?id=CVE-2024-47523
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Transports" feature allows authenticated users to inject arbitrary JavaScript through the "Details" section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0. • https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40 https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47524 – LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name
https://notcve.org/view.php?id=CVE-2024-47524
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. User with Admin role can create a Device Groups, the application did not properly sanitize the user input in the Device Groups name, when user see the detail of the Device Group, if java script code is inside the name of the Device Groups, its will be trigger. This vulnerability is fixed in 24.9.0. • https://github.com/librenms/librenms/commit/d3b51560a8e2343e520d16e9adc72c6951aa91ee https://github.com/librenms/librenms/security/advisories/GHSA-fc38-2254-48g7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47525 – Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php
https://notcve.org/view.php?id=CVE-2024-47525
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0. • https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405 https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490 https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47526 – LibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert_template.inc.php
https://notcve.org/view.php?id=CVE-2024-47526
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Self Cross-Site Scripting (Self-XSS) vulnerability in the "Alert Templates" feature allows users to inject arbitrary JavaScript into the alert template's name. This script executes immediately upon submission but does not persist after a page refresh. • https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40 https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205 https://github.com/librenms/librenms/commit/f259edc19b9f0ccca484c60b1ba70a0bfff97ef5 https://github.com/librenms/librenms/security/advisories/GHSA-gcgp-q2jq-fw52 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47527 – LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.php
https://notcve.org/view.php?id=CVE-2024-47527
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting (XSS) vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the device name ("hostname" parameter). This vulnerability can lead to the execution of malicious code in the context of other users' sessions, potentially compromising their accounts and allowing unauthorized actions. This vulnerability is fixed in 24.9.0. • https://github.com/librenms/librenms/commit/36b38a50cc10d4ed16caab92bdc18ed6abac9685 https://github.com/librenms/librenms/security/advisories/GHSA-rwwc-2v8q-gc9v • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •