CVE-2020-6585

Nagios Log Server 2.1.3 has CSRF...

CVE-2020-6586

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2020-6585

Nagios Log Server 2.1.3 has CSRF...

Cross site scripting

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2020-6584

Nagios Log Server 2.1.3 has Incorrect Access Control...

Improper access control

Nagios Log Server 2.1.3 has Incorrect Access Control...

Cross site request forgery (csrf)

Nagios Log Server 2.1.3 has CSRF...

CVE-2020-6584

Nagios Log Server 2.1.3 has Incorrect Access Control...

CVE-2020-6584

CVE-2020-6584 concerns Nagios Log Server 2.1.3 and is described as an Incorrect Access Control vulnerability. The connected CNVD entry adds that an attacker can exploit this by stealing the administrator’s CSRF token (csrf_ls) and PHPSESSID to perform the desired operation, indicating a potential...

CVE-2020-6585

Nagios Log Server 2.1.3 is affected by a cross-site request forgery (CSRF) vulnerability (CVE-2020-6585). This CVE is referenced across multiple sources (NVD, RH Red Hat, CNVD, PRION, CVE listing). CVSS scores are provided: CVSS‑2 base 6.8 (Medium) and CVSS‑3.1 base 8.8 (High). Exploitation detai...

CVE-2020-6585

Nagios Log Server 2.1.3 has CSRF...

CVE-2020-6586

Nagios Log Server 2.1.3 has a stored XSS vulnerability. The issue arises from insufficient validation of the user profile information on the profile page; a malicious user with limited access can store an XSS payload in the Name field, which is then triggered when an admin views the /admin/users ...

CVE-2020-6586

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...

CVE-2019-15898

Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page...

CVE-2019-15898

Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page...

Cross site scripting

Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page...

CVE-2019-15898

Nagios Log Server prior to 2.0.8 is affected by a reflected XSS vulnerability on the login page via the username field. The issue is confirmed across multiple sources (NVD/Red Hat entry). No explicit remediation steps or patch details are described in the provided documents beyond noting the affe...

CVE-2019-15898

Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page...

CVE-2018-7259

The FSX / P3Dv4 installer 2.0.1.231 for Flight Sim Labs A320-X sends a user's Google account credentials to http://installLog.flightsimlabs.com/LogHandler3.ashx if a pirated serial number has been entered, which allows remote attackers to obtain sensitive information, e.g., by sniffing the networ...

log4j: Socket receiver deserialization vulnerability

It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the...