Thanks, I thought they would have been since CERT usually doesn't publish until they have been fixed.
From: observium observium-bounces@observium.org On Behalf Of Adam Armstrong via observium Sent: Monday, October 5, 2020 4:38 PM To: 'Observium' observium@observium.org Cc: Adam Armstrong adama@observium.org Subject: Re: [Observium] SQL Injection?
WARNING This email originated from outside of Exegy. DO NOT CLICK links or attachments unless you recognize the sender and know the content is safe.
Yeah, these were all fixed a few weeks ago. :)
Adam.
From: observium <observium-bounces@observium.orgmailto:observium-bounces@observium.org> On Behalf Of Hamilton, Kent via observium Sent: 05 October 2020 22:06 To: Observium <observium@observium.orgmailto:observium@observium.org> Cc: Hamilton, Kent <KHamilton@Exegy.commailto:KHamilton@Exegy.com> Subject: Re: [Observium] SQL Injection?
Guess I should ask about these as well.
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=routing&proto=../ URIs to device/routing.inc.php.
2020-09-25
CVE-2020-25136https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozNzAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzYifQ.W1tW5y4spG-SqWEIl_EeAHWUtrjqCIXAXNHsJXJOuos/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozNzEsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpLzVhZTMzNWEwODBiYTQwOTk2ZDQwMjAxODE3NTllMDJmIn0.gvModKDAU081LhrAglnlxY9g7-ixRKQ0GesFgT3izIo/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the role_name or role_descr parameter to the roles/ URI.
2020-09-25
CVE-2020-25131https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozNzMsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzEifQ.EPnGyUZg-0AAOHjIvVhvbu-QZbswFeVlFqBnaJOjpZw/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozNzQsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpLzllYWI2NzViZGFmYjc5NzRkMDExNDU3OGYxZWMxODQ1In0.lxswGP5ohzoeSGzfaPvIYMD59DNNuTthzNuAnzZUtEI/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via /ajax/device_entities.php?entity_type=netscalervsvr&device_id[]= because of /ajax/device_entities.php.
2020-09-25
CVE-2020-25143https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozNzYsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDMifQ.qL8gFKjiSQYHa0wrTpiS8i8Mz0_Numlte4tabO5tpfM/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozNzcsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9haHBhbGV1cy9lNzUzODgwODYwNjFjZTUyNjE2OTY3YmE5ZWM2MzgyMCJ9.HaKkTw0DW6HB0-uqYgh-2TmOrkUoC0B7DB3cj_LSf70/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the graph_title parameter to the graphs/ URI.
2020-09-25
CVE-2020-25135https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozNzksInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzUifQ.M36cG6JMYm8IVVBtvwXbguf3muks52Og5i0Nx8INaoU/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozODAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpLzllYjk0YTYxN2E3MTkzYzZkM2I0NTVmNTM0OGJjYzFlIn0.cQ51MZjidFZUPBUImtTJluDUpqLJrp0kQytiCkixao4/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /apps/?app=../ URIs.
2020-09-25
CVE-2020-25144https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozODIsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDQifQ.rMe60q5FxvDtxvtNYybjAvcchJIa09YAoV7JNG-kAI8/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozODMsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9haHBhbGV1cy9mMjg0M2RlZWE3ZjkwZTViMzcxZTVjMDM3MGZiNzc3NSJ9.KQSLUX8RfuP40djw2gl91m4HcN7vzqK7FPwwRldoZ28/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=ports&view=../ URIs because of device/port.inc.php.
2020-09-25
CVE-2020-25145https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozODUsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDUifQ.jYYSeVjfbVeIOEJI2G7jPSGtPfxPxvhtEpKeha8wwY0/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozODYsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9haHBhbGV1cy81NzgxODY2NjdlMTg2MDdiYjM3YmFiOWIwZjY2YWQ5OSJ9.dvpgBx7hJFlz5_7fNJFgsm7KUcurL8u8dsfxdhJ2bXc/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=health&metric=../ because of device/health.inc.php.
2020-09-25
CVE-2020-25149https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozODgsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDkifQ.PnFPfCF7hPpBPZ0ZxcjXcSzKAGVoDOzNvwESvOsapCM/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozODksInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9haHBhbGV1cy9jZmE2ZGQxYzNiZjY5MjRiMjY4ZjFjYTM4MTk4YjQwZCJ9.tb5RrKGJcbW9WapAhMVh0BA_gXJOtlLwRpyKle91IOE/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending an improper variable type of Array allows a bypass of core SQL Injection sanitization. Authenticated users are able to inject malicious SQL queries. This vulnerability leads to full database leak including ckeys that can be used in the authentication process without knowing the username and cleartext password. This can occur via the ajax/actions.php group_id field.
2020-09-25
CVE-2020-25130https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozOTEsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzAifQ.Xmtd0hjQ3qV1JLMY80dxu9qTAocfnlwBlAuWbdEcfBw/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozOTIsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpLzI0M2QxZTdjMDdhZGM3MzZiYWU4MDY5ZmU4MzE3NDVjIn0.QAQ5lmf3tHztDWxHVXcEGoPjGGB5UmWsGsMXhoXzTZ8/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via la_id to the /syslog_rules URI for delete_syslog_rule, because of syslog_rules.inc.php.
2020-09-25
CVE-2020-25139https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozOTQsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzkifQ.oO2O_gd9AkGwZf_ufBfeGIgWUh3saMwhlC9EuGz-VXw/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozOTUsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpLzFlNzUyNjAyN2FlYzdhODllNzg5NTBlNWU1N2QwMDdkIn0.RMMPkw7dlllmioaZ98w0HNGXs9-V1KJb9yw1bIDy0ho/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /ports/?format=../ URIs to pages/ports.inc.php.
2020-09-25
CVE-2020-25133https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozOTcsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzMifQ.d7E_5IFs281zr4afdcme8YvpRJ5al9XBd0XvUTNL5Tg/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjozOTgsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpL2U5Nzk2YzlkODNlODIwMzAyZWEyZmZlYzVmZjliMjk4In0.97jbg3QshhgmyaVSjm_Erfzgy57MBOlPEueQXmcw5nU/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur in pages/contacts.inc.php.
2020-09-25
CVE-2020-25140https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MDAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDAifQ._iJ0FkTWvZJwqjrss9LVrc4kDW3olFbQlMhjVhgE5uo/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MDEsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2RvY3Mub2JzZXJ2aXVtLm9yZy9jaGFuZ2Vsb2cvIn0.ZIgXu0SXYtYloCFdfyaKnQZK4GZZMzQTakTABs2BxAs/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the alert_name or alert_message parameter to the /alert_check URI.
2020-09-25
CVE-2020-25137https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MDMsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzcifQ.BOcb7-nI8DzIOHCiPVPm8F1xyafT4UZoCYCf3uQFsrk/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MDQsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpLzAxNWI2MDVhOWJkMzFmNDNhODA4MGExMDVjNDMxMmE4In0.ev4rXUiRGyHRdpA0GGMjUUkdBgumpOhkQviScu-IgX8/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via /alert_check/action=delete_alert_checker/alert_test_id= because of pages/alert_check.inc.php.
2020-09-25
CVE-2020-25138https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MDYsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzgifQ.FqMLEJg0u9uWT0M3nW7ErPcZMVV0YR4xRrukU3o3WVg/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MDcsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpL2JmYjZkZWE3MzU4NmRiYjY2OGQyODBkNDEyZWNiNmQ4In0.s2wHngt75yxZ5U_K3gc2aJxnACW5TCTCRB7y1s0AdZk/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /settings/?format=../ URIs to pages/settings.inc.php.
2020-09-25
CVE-2020-25134https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MDksInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzQifQ.C7ZqdTs7w1-xJavjPJVE3lI1L2W6HG4BPHjmESjiwAY/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MTAsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpL2EzZDE4ZmMzZDcxMTNjZjljMDA0MTYxZWJkOTQyMGM5In0.eksH1hHN0qnE2iEfVrDq1-SbGnhao7RtHWVirZgwGxc/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via a /device/device=140/tab=wifi/view= URI.
2020-09-25
CVE-2020-25141https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MTIsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDEifQ.HI_mo7N_hJAvrEMeN0aiLNDz7B6A51vwwHaTktMqcZ4/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MTMsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9haHBhbGV1cy9kYTUwYTgzZWIyODZjYzY0ZGRmZmE0YTBhYTlhZGRhNSJ9.-N1olWIXgvnXCpN3Tjbz7zY4AC_cdsMCjCp6wWtKDzk/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable if any links and forms lack an unpredictable CSRF token. Without such a token, attackers can forge malicious requests, such as for adding Device Settings via the /addsrv URI.
2020-09-25
CVE-2020-25142https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MTUsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDIifQ.6z0f1TEKCZIbEKDRrU-uS8-WEPtleJkzeynK6dWNv4c/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MTYsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9haHBhbGV1cy83NmFhODFlYzgyNjQ0YTg5YzIwODhhYjNlYTk5ZjA3YyJ9.7rx_j0g5ndm9jU1-M4ge69JUDoCScjDfNAPnf8xL8m0/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via la_id to the /syslog_rules URI for edit_syslog_rule.
2020-09-25
CVE-2020-25146https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MTgsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDYifQ.0r8S4vRSXuEJtKG4c3YY2UYQSt7Oe7LC6jJ1XmDZ1mQ/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MTksInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9haHBhbGV1cy83ZjYzNjBlMTEyZTc5NTM5ZmViMTY2NjYwYmJiNzE5MyJ9.LVIvF3lqXwFA9wDKjI7IzjOFtTq9x9Ekm5aECBmOQ2w/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. this can occur via /iftype/type= because of pages/iftype.inc.php.
2020-09-25
CVE-2020-25148https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MjEsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDgifQ.6z_xa1RdL9BN4UoMVDaNIUcyxDIFE5pcsomz5x_FXwk/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjo0MjIsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9haHBhbGV1cy9mZGUwMWQxYTk0NGZlMjM3MDEwYTFlNTI0ZGQxOTE4MCJ9.hpL0wdXWVIGkdcTNfPDBieNTzs0nv4rd-ZBfihD-nRA/s/1193564013/br/86429125654-l
From: observium <observium-bounces@observium.orgmailto:observium-bounces@observium.org> On Behalf Of Hamilton, Kent via observium Sent: Monday, October 5, 2020 4:03 PM To: Observium <observium@observium.orgmailto:observium@observium.org> Cc: Hamilton, Kent <KHamilton@Exegy.commailto:KHamilton@Exegy.com> Subject: [Observium] SQL Injection?
WARNING This email originated from outside of Exegy. DO NOT CLICK links or attachments unless you recognize the sender and know the content is safe.
I noted these on this weeks CERT vulnerability report have they been addressed? I don't see anything about them on the mailing list, site or bug tracker, I could have overlooked them I guess.
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via username[0] to the default URI, because of includes/authenticate.inc.php.
2020-09-25
CVE-2020-25147https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMzgsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxNDcifQ.uFDCwlXvH7lyCJrt_mfhrw2vTuGrF1BexWPavE7MWNs/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMzksInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9haHBhbGV1cy9jOWVlMTEwOGQxNDZhOTQ0NzBmMTkxZmM0MjNiZWUxMCJ9.nXH-0l_ZDTF6nmS8lEOCMMNRkFqc8dwszWIueTeA8qc/s/1193564013/br/86429125654-l
observium -- observium
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injection sanitization. Users are able to inject malicious statements in multiple functions. This vulnerability leads to full authentication bypass: any unauthorized user with access to the application is able to exploit this vulnerability. This can occur via the Cookie header to the default URI, within includes/authenticate.inc.php.
2020-09-25
CVE-2020-25132https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxNDEsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL252ZC5uaXN0Lmdvdi9udmQuY2ZtP2N2ZW5hbWU9Q1ZFLTIwMjAtMjUxMzIifQ.BVtTcTRKhxCJiXegl88Yh5uus3kFP2l_vtODL-DlDRA/s/1193564013/br/86429125654-l MISChttps://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxNDIsInVyaSI6ImJwMjpjbGljayIsImJ1bGxldGluX2lkIjoiMjAyMDEwMDUuMjgyMzU3NTEiLCJ1cmwiOiJodHRwczovL2dpc3QuZ2l0aHViLmNvbS9tYXJpdXN6cG9wbGF3c2tpL2U3MGJjMGFmZTU4NTNlMjgzZDNmZDM1MTFhMWNlMDlkIn0.mgEK-iytzOoDsSud_7dZpzcPUSGG1LPvQZaTU_JGGH4/s/1193564013/br/86429125654-l
________________________________
This e-mail and any documents accompanying it may contain legally privileged and/or confidential information belonging to Exegy, Inc. Such information may be protected from disclosure by law. The information is intended for use by only the addressee. If you are not the intended recipient, you are hereby notified that any disclosure or use of the information is strictly prohibited. If you have received this e-mail in error, please immediately contact the sender by e-mail or phone regarding instructions for return or destruction and do not use or disclose the content to others.
________________________________
This e-mail and any documents accompanying it may contain legally privileged and/or confidential information belonging to Exegy, Inc. Such information may be protected from disclosure by law. The information is intended for use by only the addressee. If you are not the intended recipient, you are hereby notified that any disclosure or use of the information is strictly prohibited. If you have received this e-mail in error, please immediately contact the sender by e-mail or phone regarding instructions for return or destruction and do not use or disclose the content to others.
________________________________
This e-mail and any documents accompanying it may contain legally privileged and/or confidential information belonging to Exegy, Inc. Such information may be protected from disclosure by law. The information is intended for use by only the addressee. If you are not the intended recipient, you are hereby notified that any disclosure or use of the information is strictly prohibited. If you have received this e-mail in error, please immediately contact the sender by e-mail or phone regarding instructions for return or destruction and do not use or disclose the content to others.