Nagios XI Version 2024R1.01 - SQL Injection

Exploit Title: NAGIOS XI SQLI Google Dork: if applicable Date: 02/26/2024 Exploit Author: Jarod Jaslow MAWK https://www.linkedin.com/in/jarod-jaslow-codename-mawk-265144201/ Vendor Homepage: https://www.nagios.com/changelog/nagios-xi Software Link: https://github.com/MAWK0235/CVE-2024-24401...

CVE-2024-24401

creationtimestamp| type| source ---|---|--- 2024-02-26 18:26:36+00:00| seen| https://t.me/ctinow/193613 2024-02-26 18:32:14+00:00| seen| https://t.me/ctinow/193620 2024-02-26 21:55:40+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6679 2024-02-27 14:17:06+00:00| seen|...

CVE-2024-24401

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component...

CVE-2024-24401

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component...

CVE-2024-24401

CVE-2024-24401 affects Nagios XI version 2024R1.01 and is described in connected exploits as an authenticated SQL Injection targeting the monitoringwizard.php endpoint (Nagios XI

Exploit for SQL Injection in Nagios Nagios_Xi

Vulnerability Report CVE Disovered by: Jarod Jaslow MAWK...

CVE-2022-24401

Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of...

CVE-2022-24401 Keystream recovery for arbitrary frames in TETRA

Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of...

CVE-2022-24401

CVE-2022-24401 concerns the TETRA system’s Air Interface Encryption (AIE) keystream generator. The root cause is IV generation based on TDMA frame counters broadcast unauthenticated, enabling an adversary to manipulate counters observed by a mobile station and provoke keystream re-use. This can a...

CVE-2023-24401

creationtimestamp| type| source ---|---|--- 2023-08-30 20:12:34+00:00| seen| https://t.me/cibsecurity/69473...

CVE-2023-24401

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Davidsword Mobile Call Now & Map Buttons plugin = 1.5.0 versions...

CVE-2023-24401

CVE-2023-24401 is a Stored XSS vulnerability in the WordPress plugin Davidsword Mobile Call Now & Map Buttons (versions

WordPress Mobile Call Now & Map Buttons Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)

Software Mobile Call Now & Map Buttons Type Plugin Vulnerable versions = 1.5.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Scripting XSS CVE CVE-2023-24401 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a547a52ae1b5 Credits Abdi Pranata...

CVE-2021-24401

creationtimestamp| type| source ---|---|--- 2021-09-20 14:26:46+00:00| seen| https://t.me/cibsecurity/29084...

CVE-2021-24401

CVE-2021-24401 affects the WP Domain Redirect WordPress plugin (

CVE-2020-24401

CVE-2020-24401 — Magento : Affected are Magento versions 2.4.0 and 2.3.5p1 (and earlier). Root cause: incorrect authorization that lets a user continue to access resources provisioned under their old role after an administrator removes the role or disables the account. Impact: accounts may retain...

CVE-2020-24401 Incorrect permissions following the deletion of a user role or deactivation of a user

Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account...