CVE-2018-15708

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request...

CVE-2018-15709

Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request...

CVE-2018-15709

CVE-2018-15709 affects Nagios XI 5.5.6, allowing remote authenticated attackers to execute arbitrary commands via crafted HTTP requests. Technical details across connected advisories indicate a command-injection issue in the Nagios XI Cmdsubsys/ajaxhelper.php submitcommand path, driven by insuffi...

CVE-2018-15714

Nagios XI 5.5.6 is affected by a reflected cross-site scripting vulnerability exploitable by remote, unauthenticated attackers via the oname and oname2 parameters. The issue is described across multiple sources (NVD, CNVD, PRION/OpenVAS entries) consistently as a cross-site scripting flaw in Nagi...

CVE-2018-15710

Nagios XI 5.5.6 is affected by CVE-2018-15710: local authenticated privilege escalation via Autodiscover_new.php. Public exploit coverage exists (Exploit-DB 46221/47039) and a Metasploit module is available describing root-level execution. The provided documents do not specify a patched version o...

CVE-2018-15712

Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in apitool.php...

CVE-2018-15714

Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters...

CVE-2018-15711

Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges...

CVE-2018-15708

CVE-2018-15708 affects Nagios XI 5.5.6 (Snoopy 1.0) and enables unauthenticated remote command execution via a crafted HTTP request. Exploit code and public disclosures (Exploit-DB/Metasploit modules) show the vulnerability is used to achieve remote code execution; a Metasploit module also notes ...

Nagios XI Magpie_debug.php Root Remote Code Execution

This module exploits two vulnerabilities in Nagios XI use exploit/linux/http/nagios/ximagpiedebug msf undefinedximagpiedebug show actions ...actions... msf undefinedximagpiedebug set ACTION msf undefinedximagpiedebug show options ...show and set options... msf undefinedximagpiedebug run This modu...

Nagios XI RCE via Snoopy Library

Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. Recent assessments: space-r7 at June 28, 2019 3:23pm UTC reported: If this vulnerability is found in the wild, then it’s likely that the target is vulnerable to...

SUSE SLES11 Security Update : nagios (SUSE-SU-2018:3240-1)

This update for nagios fixes the following issues : CVE-2016-8641 / CVE-2016-10089: fixed possible symlink attacks for files/directories created by root bsc1011630 / bsc1018047 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisor...

SUSE-SU-2018:3240-1 Security update for nagios

This update for nagios fixes the following issues: - CVE-2016-8641 / CVE-2016-10089: fixed possible symlink attacks for files/directories created by root bsc1011630 / bsc1018047...

nagios.ryttargardskyrkan.se XSS vulnerability

Open Bug Bounty ID: OBB-678602 Description| Value ---|--- Affected Website:| nagios.ryttargardskyrkan.se Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-16145

The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited by the nagios user, and would allow attackers to elevate their privileges to root after a system restart, hence obtaining full control of...

CVE-2018-16145

The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited by the nagios user, and would allow attackers to elevate their privileges to root after a system restart, hence obtaining full control of...

CVE-2018-16146

The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection wi...

CVE-2018-16145

Opsview Monitor vulnerability CVE-2018-16145 affects the boot-time script /etc/init.d/opsview-reporting-module, which runs with Nagios privileges and can be used to elevate to root after a reboot by editing the /opt/opsview/jasper/bin/db_jasper component. The root cause is that the vulnerable scr...

Opsview Monitor Command Execution Vulnerability (CNVD-2018-17452)

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor has a command execution vulnerability that allows an attacker to gain acces...

Opsview Monitor Local Elevation of Privilege Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a local elevation of privilege vulnerability that allows an...