CVE-2025-34284

Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitatio...

CVE-2020-36868

Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some...

CVE-2023-7317 Nagios XI < 2024R1 Web SSH Terminal Missing Access Control

Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of...

CVE-2020-36868 Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script

Nagios XI versions prior to 5.7.3 contain a privilege escalation vulnerability in the getprofile.sh helper script. The script performed profile retrieval and initialization routines using insecure file/command handling and insufficient validation of attacker-controlled inputs, and in some...

CVE-2018-25122 Nagios XI < 5.4.13 Component Download Page RCE

Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inje...

CVE-2013-10073 Nagios XI < 2012R1.6 Auto-Discovery Shell Command Injection

Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell without adequate sanitation or argument quoting, allowing an authenticated user with access to discovery functionality to execute arbitrary...

MAL-2025-49096 Malicious code in example-icrc35-shared-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7e6839f13b54dc75f2b851ec1c1e78a9bbf4591f438a2053c99658e5f60189 The package example-icrc35-shared-library was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in create-response (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242fbf21e70f13fac07ad9415ae43d91bc17823a931c07c5143ae7f7119a2b24 The package create-response was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49095 Malicious code in create-response (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242fbf21e70f13fac07ad9415ae43d91bc17823a931c07c5143ae7f7119a2b24 The package create-response was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in int_affirm_controllers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c121a8e42740e77bf8fbd68555baf163e58d04b145e5ad42bbc0feb3a087628 The package intaffirmcontrollers was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49097 Malicious code in int_affirm_controllers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c121a8e42740e77bf8fbd68555baf163e58d04b145e5ad42bbc0feb3a087628 The package intaffirmcontrollers was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-49094 Malicious code in app_storefront_core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d146e3723013cdb936cc74fc9a48a5aa197031f136e710ce28e0ceda08d8399d The package appstorefrontcore was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in app_storefront_core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d146e3723013cdb936cc74fc9a48a5aa197031f136e710ce28e0ceda08d8399d The package appstorefrontcore was found to contain malicious code. Source: ossf-package-analysis...

PT-2025-44491

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1 Description Nagios XI versions prior to 2024R1 have a missing access control issue through the Web SSH Terminal. A remote attacker with low privileges could access or interact with the terminal interface...

Dell Unity 操作系统命令注入漏洞

Dell Unity is a mid-range storage solution from Dell that supports file storage, block storage, and a variety of data services features designed to meet the needs of organizations for flexibility, cost-effectiveness, and simplicity. Dell Unity suffers from an operating system command injection...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI prior to version 2024R1, which stems from a lack of access...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2012R1.6, which stems from the Auto-Discove...

CVE-2020-36869: Improper Neutralization of Special Elements used in an SQL Command

Nagios XI versions prior to 5.7.5 contain a SQL injection vulnerability in the SNMP Trap Interface edit page. Exploitation requires an account with administrative privileges to access the affected interface. A user with administrative access could supply crafted input that is not properly...

CVE-2013-10073: Improper Neutralization of Special Elements used in an OS Command

Nagios XI versions prior to 2012R1.6 contain a shell command injection vulnerability in the Auto-Discovery tool. User-controlled input is passed to a shell without adequate sanitation or argument quoting, allowing an authenticated user with access to discovery functionality to execute arbitrary...

Malicious code in siren-lament (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9146581b28381099b9aea208feeb40077658b468ce7897143988b86a5ec23b The package siren-lament was found to contain malicious code. Source: ossf-package-analysis...