Nagios XI 5.7.3 - 'Manage Users' Authenticated SQL Injection

Exploit Title: Nagios XI 5.7.3 - 'Manage Users' Authenticated SQL Injection Date: 10-18-2020 Exploit Author: Matthew Aberegg Vendor Homepage: https://www.nagios.com/products/nagios-xi/ Vendor Changelog: https://www.nagios.com/downloads/nagios-xi/change-log/ Software Link:...

[SECURITY] Fedora 32 Update: dnf-plugins-core-4.0.18-1.fc32

Core Plugins for DNF. This package enhances DNF with builddep, config-manag er, copr, debug, debuginfo-install, download, needs-restarting, repoclosure, repograph, repomanage, reposync, changelog and repodiff commands. Additiona lly provides generatecompletioncache passive plugin...

CVE-2020-0119

In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for...

Security Bulletin: Potential Information Disclosure in IBM WebSphere Application Server affects IBM Tivoli Netcool Configuration Manager (ITNCM) (CVE-2016-9736)

Summary There is a potential Information Disclosure vulnerability in IBM WebSphere Application Server that is used by IBM Tivoli Netcool Configuration Manager ITNCM. Vulnerability Details CVEID: CVE-2016-9736 DESCRIPTION: IBM WebSphere Application Server using malformed SOAP requests could allow ...

CVE-2018-17051

K-Net Cisco Configuration Manager through 2014-11-19 has XSS via devices.php...

Nagios XI core config manager authentication bypass vulnerability

Nagios XI is an IT infrastructure monitoring solution from Nagios, Inc. that supports monitoring and alerting of applications, services, operating systems, etc. core config manager is one of the core configuration managers. The solution supports monitoring and alerting of applications, services,...

CVE-2018-8734

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter...

CVE-2018-8734

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter...

CVE-2018-8734

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter...

CVE-2018-8734

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter...

CVE-2018-8734: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter...

CVE-2018-8733: Improper Neutralization of Special Elements used in an SQL Command

Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability...

PT-2018-18605

Name of the Vulnerable Software and Affected Versions Nagios XI versions 5.2.x through 5.4.x before 5.4.13 Description The issue allows an unauthenticated attacker to bypass authentication in the core config manager, enabling them to make configuration changes. This can also be leveraged to explo...

PT-2018-18606

Name of the Vulnerable Software and Affected Versions Nagios XI versions 5.2.x through 5.4.x before 5.4.13 Description A SQL injection issue exists in the core config manager, allowing an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter. Recommendations For Nagios XI...

CVE-2017-14352

HP UCMDB Configuration Manager (HPE UCMDB) applications versions 10.10–10.23 are affected by a cross-site scripting vulnerability. The CVE-2017-14352 entry notes remote exploitation could allow script execution in a user’s browser. CVSSv3 vectors indicate NETWORK access, LOW attack complexity, PR...

Secure Auditor 3.0 - Directory Traversal

Secure Auditor 3.0 - Directory Traversal + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SECURE-AUDITOR-v3.0-DIRECTORY-TRAVERSAL.txt + ISR: ApparitionSec Vendor: ==================== www.secure-bytes.com Product:...

Sql injection

SQL injection vulnerability in functions/prependadm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php...

CVE-2013-6875

SQL injection vulnerability in functions/prependadm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php...

Nagios Core Config Manager tfPassword SQL Injection

An SQL Injection vulnerability has been reported in Nagios Core Config Manager. The vulnerability is due to improper validation of the tfPassword parameter passed to the application. A remote unauthenticated attacker could exploit this vulnerability by sending a request with a crafted tfPassword...