Stack overflow

Multiple stack-based buffer overflows in the gethistory function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long 1 hostname variable host parameter or 2...

CVE-2012-6096

Multiple stack-based buffer overflows in the gethistory function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long 1 hostname variable host parameter or 2...

CVE-2012-6096

CVE-2012-6096 describes multiple stack-based buffer overflows in Nagios Core before 3.4.4 and Icinga 1.6.x/1.7.x/1.8.x before respective fixed points, exploitable via a long host_name (host) or svc_description parameter in history.cgi get_history. Evidence in connected docs shows public disclosur...

CVE-2012-6096

Multiple stack-based buffer overflows in the gethistory function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long 1 hostname variable host parameter or 2...

CVE-2012-6096

Removed by vendor...

PT-2013-1886

Name of the Vulnerable Software and Affected Versions Nagios Core versions prior to 3.4.4 Icinga versions 1.6.x prior to 1.6.2 Icinga versions 1.7.x prior to 1.7.4 Icinga versions 1.8.x prior to 1.8.4 Description The issue is related to multiple stack-based buffer overflows in the get history...

CVE-2012-6096: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in the gethistory function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long 1 hostname variable host parameter or 2...

[BSA-079] Security Update for icinga

Jan Wagner uploaded new packages for icinga which fixed the following security problems: CVE-2012-6096 CGI buffer overflows https://security-tracker.debian.org/tracker/CVE-2012-6096 For the squeeze-backports distribution the problems have been fixed in version 1.7.1-5bpo60+1 of the icinga package...

CVE-2012-3441

The database creation script module/idoutils/db/scripts/createmysqldb.sh in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors...

CVE-2012-3441

The database creation script module/idoutils/db/scripts/createmysqldb.sh in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors...

Design/Logic Flaw

The database creation script module/idoutils/db/scripts/createmysqldb.sh in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors...

CVE-2012-3441

CVE-2012-3441 concerns Icinga 1.7.1 where the database creation script (module/idoutils/db/scripts/create_mysqldb.sh) grants the icinga user access to all databases. This explicit action enables icinga users to access other databases via unspecified vectors, per multiple connected sources (NVD, S...

CVE-2012-3441

The database creation script module/idoutils/db/scripts/createmysqldb.sh in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors...

CVE-2012-3441

Removed by vendor...

PT-2012-4714

Name of the Vulnerable Software and Affected Versions Icinga version 1.7.1 Description The issue in Icinga allows the icinga user to access all databases due to the database creation script granting excessive access. This could potentially be exploited via unspecified vectors, allowing icinga use...

CVE-2012-3441: Undefined Security Weakness

The database creation script module/idoutils/db/scripts/createmysqldb.sh in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors...

CVE-2011-2477

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escapehtmltags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a...

CVE-2011-2179

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...

CVE-2011-2477

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escapehtmltags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escapehtmltags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a...