Vulnerabilidades em librenms

95 resultados
Análise Vexday

O LibreNMS acumula 74 CVEs catalogadas, sem nenhuma confirmada em exploração ativa no catálogo CISA KEV — taxa abaixo da média geral do catálogo. Ainda assim, o cenário merece atenção: a CVE mais perigosa identificada, CVE-2022-3562, apresenta EPSS de 0,9422, indicando altíssima probabilidade estatística de exploração, e há 2 vulnerabilidades com PoC pública disponível, o que reduz a barreira técnica para atacantes. A falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que, embora frequentemente subestimado, pode ser encadeado com outras fraquezas para escalada de impacto em aplicações de monitoramento de rede com acesso privilegiado. Equipes que mantêm instâncias do LibreNMS devem priorizar a remediação da CVE-2022-3562 e revisar exposições relacionadas a XSS, especialmente em ambientes acessíveis externamente.

CVE-2022-4070LOWInsufficient Session Expiration in librenms/librenmsEPSS 0.7%CVE-2023-4981HIGHCross-site Scripting (XSS) - DOM in librenms/librenmsEPSS 0.7%CVE-2023-5060HIGHCross-site Scripting (XSS) - DOM in librenms/librenmsEPSS 0.6%CVE-2024-47523HIGHLibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" featureEPSS 0.6%CVE-2022-0772MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.6%CVE-2026-86427HIGHLibreNMS before 26.8.0 Argument Injection via graph_titleEPSS 0.6%CVE-2023-46745MEDIUMRate limiting Bypass on login page in libreNMSEPSS 0.6%CVE-2026-109357CRITICALLibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization HeaderEPSS 0.6%CVE-2022-3561MEDIUMCross-site Scripting (XSS) - Generic in librenms/librenmsEPSS 0.6%CVE-2023-48295MEDIUMCross-site Scripting at Device groups Deletion feature in LibreNMSEPSS 0.6%CVE-2026-80214HIGHLibreNMS Virtualisation Discovery Module RCEEPSS 0.5%CVE-2024-47524HIGHLibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" NameEPSS 0.5%CVE-2023-4977HIGHCode Injection in librenms/librenmsEPSS 0.5%CVE-2024-47527HIGHLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.phpEPSS 0.5%CVE-2022-3516MEDIUMCross-site Scripting (XSS) - Stored in librenms/librenmsEPSS 0.5%CVE-2024-52526MEDIUMLibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.phpEPSS 0.5%CVE-2024-47526LOWLibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert_template.inc.phpEPSS 0.5%CVE-2020-36947HIGHLibreNMS 1.46 - MAC Accounting Graph Authenticated SQL InjectionEPSS 0.5%CVE-2020-15875MEDIUMAn issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LiEPSS 0.5%CVE-2024-51496MEDIUMLibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.phpEPSS 0.4%