3757 matches found
Cross site request forgery (csrf)
Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request...
CVE-2018-15710
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscovernew.php...
CVE-2018-15714
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters...
CVE-2018-15709
Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request...
CVE-2018-15714
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters...
CVE-2018-15712
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in apitool.php...
CVE-2018-15708
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request...
CVE-2018-15709
Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request...
Code injection
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscovernew.php...
CVE-2018-15710
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscovernew.php...
Code injection
Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges...
CVE-2018-15708
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request...
Cross site scripting
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php...
CVE-2018-15711
Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges...
CVE-2018-15713
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php...
CVE-2018-15713
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php...
CVE-2018-15713
CVE-2018-15713 affects Nagios XI 5.5.6 and enables a persistent cross-site scripting vulnerability via the stored email address in admin/users.php. The NVD entry indicates a MEDIUM overall impact (CVSSv3.0: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N; base score 5.4) requiring remote access with low priv...
CVE-2018-15712
Nagios XI 5.5.6 is affected by CVE-2018-15712: a reflected cross-site scripting flaw exploitable by remote unauthenticated attackers via the host parameter in api_tool.php. The issue is documented across multiple feeds (NVD, CNVD, CVE listings, and advisories) with consistent description of remot...
CVE-2018-15711
Nagios XI 5.5.6 contains a privilege-escalation flaw in the API key management. A remote, authenticated attacker can reset and regenerate the API key of a higher-privileged user, then use the new key to perform API calls with elevated privileges. This is described consistently across multiple sou...