OpsView Monitor Detection

Detection of OpsView Monitor. The script sends a connection request to the server and attempts to detect OpsView Monitor and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

Opsview Monitor Cross-Site Scripting Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a cross-site scripting vulnerability that can be exploited by ...

Opsview Monitor Local Elevation of Privilege Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a local elevation of privilege vulnerability that allows an...

CVE-2018-16147: Improper Neutralization of Input During Web Page Generation

The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting...

CVE-2018-16148: Improper Neutralization of Input During Web Page Generation

The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting...

CVE-2018-16144: Improper Neutralization of Special Elements used in an OS Command

The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command injection due to improper sanitization of the rancidpassword parameter...

CVE-2018-16146: Improper Neutralization of Special Elements used in an OS Command

The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection wi...

Opsview Monitor Cross-Site Scripting Vulnerability (CNVD-2018-17454)

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a cross-site scripting vulnerability that can be exploited by ...

Opsview Monitor 5.x Command Execution

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Opsview Monitor Multiple Vulnerabilities 1. Advisory Information Title: Opsview Monitor Multiple Vulnerabilities Advisory ID: CORE-2018-0008 Advisory URL:...

Opsview Monitor Command Execution Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor has a command execution vulnerability that allows an attacker to gain acces...

CVE-2018-16145: Incorrect Permission Assignment for Critical Resource

The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited by the nagios user, and would allow attackers to elevate their privileges to root after a system restart, hence obtaining full control of...

Multiple Remote Code-Execution Flaws Patched in Opsview Monitor

A slew of vulnerabilities have been disclosed in Opsview Monitor a proprietary IT monitoring software for networks and applications, which could enable remote code-execution, command-execution and local privilege-escalation. A total of five flaws CVE-2018-16148, CVE-2018-16147, CVE-2018-16146,...

Opsview Monitor Multiple Vulnerabilities

Advisory ID Internal CORE-2018-0008 1. Advisory Information Title: Opsview Monitor Multiple Vulnerabilities Advisory ID: CORE-2018-0008 Advisory URL:https://www.coresecurity.com/core-labs/advisories/opsview-monitor-multiple-vulnerabilities Date published: 2018-09-04 Date of last update: 2018-09-0...

Opsview Monitor Pro Open Redirect Vulnerability

Opsview Monitor Pro is a suite of enterprise-class network, server and application monitoring tools from Opsview UK. The tool can be integrated with monitoring systems such as Nagios Core, RRDTool and others. An open redirection vulnerability exists in Opsview Monitor Pro. A remote attacker can...

Opsview Monitor Pro Path Traversal Vulnerability

Opsview Monitor Pro is a suite of enterprise-class network, server and application monitoring tools from Opsview UK. The tool can be integrated with monitoring systems such as Nagios Core, RRDTool and others. A directory traversal vulnerability exists in Opsview Monitor Pro. An attacker could...

CVE-2016-10368

Open redirect vulnerability in Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the...

CVE-2016-10367

In Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding...

Open redirect

Open redirect vulnerability in Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the...

CVE-2016-10367

In Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding...

Directory traversal

In Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding...