CVE-2020-6581

Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nastymetachars interprets \n as the character \ and the character n not as the \n newline sequence. This can cause command injection...

CVE-2020-6584

Nagios Log Server 2.1.3 has Incorrect Access Control...

CVE-2020-6584

Nagios Log Server 2.1.3 has Incorrect Access Control...

CVE-2020-6585

Nagios Log Server 2.1.3 has CSRF...

CVE-2020-6586

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2020-6585

Nagios Log Server 2.1.3 has CSRF...

CVE-2020-6586

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

Cross site scripting

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2020-6586

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2020-6585

Nagios Log Server 2.1.3 has CSRF...

Cross site request forgery (csrf)

Nagios Log Server 2.1.3 has CSRF...

CVE-2020-6584

Nagios Log Server 2.1.3 has Incorrect Access Control...

Improper access control

Nagios Log Server 2.1.3 has Incorrect Access Control...

CVE-2020-6584

Nagios Log Server 2.1.3 has Incorrect Access Control...

CVE-2020-6584

CVE-2020-6584 concerns Nagios Log Server 2.1.3 and is described as an Incorrect Access Control vulnerability. The connected CNVD entry adds that an attacker can exploit this by stealing the administrator’s CSRF token (csrf_ls) and PHPSESSID to perform the desired operation, indicating a potential...

CVE-2020-6585

Nagios Log Server 2.1.3 is affected by a cross-site request forgery (CSRF) vulnerability (CVE-2020-6585). This CVE is referenced across multiple sources (NVD, RH Red Hat, CNVD, PRION, CVE listing). CVSS scores are provided: CVSS‑2 base 6.8 (Medium) and CVSS‑3.1 base 8.8 (High). Exploitation detai...

CVE-2020-6585

Nagios Log Server 2.1.3 has CSRF...

CVE-2020-6586

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2020-6586

Nagios Log Server 2.1.3 has a stored XSS vulnerability. The issue arises from insufficient validation of the user profile information on the profile page; a malicious user with limited access can store an XSS payload in the Name field, which is then triggered when an admin views the /admin/users ...

Nagios XI Authenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nagios XI Authenticated Remote Command Execution', 'Description' = %q This module exploits a vulnerability in Nagios XI before 5.6.6 in order to...