CVE-2024-49369

CVE-2024-49369 Overview This vulnerability leverages the Icinga JSON-RPC protocol to exploit monitored nodes running Icinga agents. By impersonating a Master/Satellite instance, attackers can potentially take over agents, execute arbitrary commands, or gain sensitive information. How to Use...

CVE-2022-24716-2

CVE-2022-24716 Icinga Web 2 is an open source monitoring web interface, framework and command line interface. Unauthenticated users can leak the contents of user-accessible local system files from the web server, including icingaweb2 configuration files with database credentials. Installation Usa...

CVE-2022-24716

CVE-2022-24716 Exploit for the vulnerability: Arbitrary File Disclosure Vulnerability in Icinga Web 2 2.8.6, 2.9.6, 2.10 DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems you have written permission to exploit...

CVE-2022-24716

CVE-2022-24716 Icinga Web 2 is a software application that monitors computer systems and networks. It has a web interface that allows users to view and manage system resources. However, there is a vulnerability in Icinga Web 2 that allows unauthenticated users to access files on the system that a...

CVE-2022-24715

Icinga Web 2 - Authenticated Remote Code Execution 2.8.6, 2.9.6, 2.10 Remote command execution Reverse shell Usage usage: exploit.py -h -u URL -U USER -P PASSWORD -i IP -p PORT Welcome. options: -h, --help show this help message and exit -u URL, --url URL Insert URL http://ipvictima -U USER, --us...

CVE-2022-24715-go

CVE-2022-24715 The Icinga Web 2 exploit written in go. The original python code can be found in: https://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html...

CVE-2022-24716

CVE-2022-24716 Arbitrary File Disclosure Vulnerability in Icinga Web 2 2.8.6, 2.9.6, 2.10 Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user,...

CVE-2022-24715

CVE-2022-24715 Icinga Web 2 - Authenticated Remote Code Execution 2.8.6, 2.9.6, 2.10 DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems you have written permission to exploit...

CVE-2022-24716

CVE-2022-24716 Exploit for the vulnerability: Arbitrary File Disclosure Vulnerability in Icinga Web 2 2.8.6, 2.9.6, 2.10 https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/ Help: python3 exploit.py -h Usage example: python3 -u http://127.0.0.1:8080 -f /etc/passwd...

SUSE CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

SUSE CVE-2026-61551

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

SUSE CVE-2026-61552

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...

CVE-2026-61552

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

CVE-2026-61551

Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack because nesting depth is not bounded. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port...

CVE-2026-61552

Icinga 2 , an open source monitoring and alerting system, is affected by a DSL injection vulnerability in the /v1/objects API . The root cause is that attacker-controlled template names are written into generated configuration without escaping , allowing an authenticated ApiUser with an objects/c...

EUVD-2026-83211

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...

CVE-2026-61552 Icinga 2 DSL Injection via Unescaped Import Template Name

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...

CVE-2026-61552 Icinga 2 DSL Injection via Unescaped Import Template Name

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...

CVE-2026-61552 Icinga 2 DSL Injection via Unescaped Import Template Name

Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/ permission can inject Icinga 2 DSL...