CVE-2018-16144

The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command injection due to improper sanitization of the rancidpassword parameter...

CVE-2018-16147

The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting...

CVE-2018-16144

CVE-2018-16144 affects Opsview Monitor NetAudit: the test connection function can be abused to inject commands via the rancid_password parameter. CoreLabs/ThreatPost detail remote command execution possibilities with PoCs showing reverse shells, affecting Opsview Monitor 5.4, 5.3 and 5.2. Fixed i...

CVE-2018-16147

Opsview Monitor CVE-2018-16147 is a stored XSS in the data parameter of the /settings/api/router endpoint. Affected versions include Opsview Monitor 5.3 and 5.4 (and 5.2 per CORE-2018-0008) prior to fixes. The vulnerability can allow an attacker to inject JavaScript executed in the context of an ...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Enterprise Content Management System Monitor

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 7 used by Enterprise Content Management System Monitor. These issues were disclosed as part of the IBM® SDK Java™ Technology Edition Quarterly CPU - Jan 2018 - Includes Oracle Jan 2018 CPU. Vulnerability...

PT-2018-13424

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions 5.4.x through 5.4.1 Description The issue affects the web management console, where an authenticated administrator can exploit a command injection flaw due to improper sanitization of the value parameter. This allows f...

CVE-2018-16148: Improper Neutralization of Input During Web Page Generation

The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting...

Opsview Monitor 5.x Command Execution

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Opsview Monitor Multiple Vulnerabilities 1. Advisory Information Title: Opsview Monitor Multiple Vulnerabilities Advisory ID: CORE-2018-0008 Advisory URL:...

PT-2018-13426

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions prior to 5.3.1 Opsview Monitor versions 5.4.x prior to 5.4.2 Description The issue concerns the diagnosticsb2ksy parameter of the "/rest" endpoint, which is susceptible to Cross-Site Scripting. Recommendations For...

PT-2018-13422

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions prior to 5.3.1 Opsview Monitor versions 5.4.x prior to 5.4.2 Description The issue arises from improper sanitization of the rancid password parameter in the test connection functionality of the NetAudit section, leadin...

CVE-2018-16145: Incorrect Permission Assignment for Critical Resource

The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited by the nagios user, and would allow attackers to elevate their privileges to root after a system restart, hence obtaining full control of...

CVE-2018-16144: Improper Neutralization of Special Elements used in an OS Command

The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command injection due to improper sanitization of the rancidpassword parameter...

CVE-2018-16146: Improper Neutralization of Special Elements used in an OS Command

The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection wi...

Opsview Monitor Cross-Site Scripting Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a cross-site scripting vulnerability that can be exploited by ...

Opsview Monitor Local Elevation of Privilege Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a local elevation of privilege vulnerability that allows an...

CVE-2018-16147: Improper Neutralization of Input During Web Page Generation

The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting...

PT-2018-13425

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions prior to 5.3.1 Opsview Monitor versions 5.4.x prior to 5.4.2 Description The issue concerns the /settings/api/router endpoint, where the data parameter is vulnerable to Cross-Site Scripting. Recommendations For version...

Opsview Monitor Command Execution Vulnerability (CNVD-2018-17452)

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor has a command execution vulnerability that allows an attacker to gain acces...

Opsview Monitor Command Execution Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor has a command execution vulnerability that allows an attacker to gain acces...

Opsview Monitor Cross-Site Scripting Vulnerability (CNVD-2018-17454)

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a cross-site scripting vulnerability that can be exploited by ...