Sql injection

DISPUTED Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid...

CVE-2019-12279

CVE-2019-12279 affects Nagios XI 5.6.1, where the reset-password form (login.php?forgotpass) accepts a username parameter that is used in a SQL query. The issue is described as a potential SQL injection, but the vendor disputes it as a vulnerability, noting that the input is passed through SQL es...

CVE-2019-12279

Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...

PT-2019-12731 · Nagios · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 5.6.1 Description: The issue concerns a potential SQL injection via the username parameter to "login.php?forgotpass" also known as the reset password form. However, the vendor disputes this as a vulnerability, stating that t...

Nagios XI SQL Injection Vulnerability (CNVD-2019-15672)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A SQL injection vulnerability exists in Nagios XI version 5.6.1, which can be exploited by attackers to...

Fedora Update for nagios FEDORA-2019-376ecc221c

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Command Injection

Snoopy library is vulnerable to command injection attacks. This allows remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers which may leads to data modification...

Privilege Escalation

Nagios is vulnerable to privilege escalation attacks. An attacker who is able to control the Nagios logging configuration the 'nagios' user/group, could use this flaw to elevate their privileges to root which leads to information modification...

Command Injection

Snoopy library is vulnerable to command injection attacks. This allows remote attackers to execute arbitrary commands by manipulating Nagios HTTP headers which may leads to data modification...

Arbitrary Code Execution

Red Hat Gluster Storage is a software only scale-out storage solution that provides flexible and affordable unstructured data storage. It unifies data storage and infrastructure, increases performance, and improves availability and manageability to meet enterprise-level storage challenges. Red Ha...

Improper Access Control

Red Hat Gluster Storage is a software only scale-out storage solution that provides flexible and affordable unstructured data storage. It unifies data storage and infrastructure, increases performance, and improves availability and manageability to meet enterprise-level storage challenges. Red Ha...

Symlink Attack

Nagios is a program that can monitor hosts and services on your network. It can send email or page alerts when problems arise and when problems are resolved. Multiple insecure temporary file creation flaws were found in Nagios. A local attacker could use these flaws to cause arbitrary files to be...

Nagios XI 5.5.10 XSS / Remote Code Execution Vulnerability

Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim with "autodiscovery job" creation privileges to visit a malicious URL to obtain a remote root shell via a reflected cross site scripting, an authenticated remot...

NagiosXI Privilege Mobilization Vulnerability

Nagios XI is a network monitoring software that provides network, server and application monitoring solutions for organizations. NagiosXI suffers from a boost vulnerability that can be exploited by an attacker to gain root privileges...

Nagios XI 5.5.10 XSS / Remote Code Execution

Nagios XI 5.5.10: XSS to Pubblicato dapolict 10 Aprile 2019 Tl;dr A remote attacker could trick an authenticated victim with “autodiscovery job” creation privileges to visit a malicious URL and obtain a remote root shell via a reflected Cross-Site Scripting XSS, an authenticated Remote Code...

Nagios IM SQL Injection Vulnerability

Nagios Incident Manager IM is a network time manager from the US-based Nagios. The product is primarily used to manage and track network event history. A SQL injection vulnerability exists in Nagios IM versions prior to 2.2.7. A remote attacker can exploit this vulnerability to execute arbitrary...

Nagios XI Command Injection Vulnerability

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A command injection vulnerability exists in Nagios XI versions prior to 5.5.11. The vulnerability can be exploited by authenticated...

Nagios XI SQL Injection Vulnerability (CNVD-2019-10017)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A SQL injection vulnerability exists in Nagios XI versions prior to 5.5.11. The vulnerability can be exploited by an attacker to execu...

Nagios XI Elevation of Privilege Vulnerability (CNVD-2019-10018)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. An elevation of privilege vulnerability exists in Nagios XI versions prior to 5.5.11. A local attacker can exploit this vulnerability ...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2019-10019)

Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting and rich data visualization. A cross-site scripting vulnerability exists in Nagios XI versions prior to 5.5.11. An attacker can exploit this vulnerability to injec...