Thruk-CVE-2023-34096

Thruk-CVE-2023-34096 Thruk Monitoring Web Interface 버전 = v3.06은 CVE-2023-34096 Path Traversal에 취약합니다. 현재 익스플로잇은 Python 3로 작성되었으며, 이 취약점을 이용하여 여러 Thruk 공통 폴더 및 일부 Linux 폴더에 PoC 파일을 업로드합니다. CVSS CNA GitHub, Inc.는 이 발견에 대해 CVSS 3.1 점수 6.5 Medium을 부여했습니다. NIST NVD 확인...

Thruk 2.40-2 - Cross-Site Scripting

Thruk 2.40-2 contains a cross-site scripting vulnerability via /thruk/cgi-bin/status.cgi?style=combined&title=TITLE in the host or title parameter. An attacker can inject arbitrary JavaScript into status.cgi, leading to a triggered payload when accessed by an authenticated user. id: CVE-2021-3548...

CVE-2022-23961

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface...

EUVD-2022-28877

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface...

CVE-2022-23961

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface...

CVE-2022-23961: Improper Neutralization of Input During Web Page Generation

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface...

CVE-2022-23961

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface...

Thruk Monitoring 跨站脚本漏洞

Thruk Monitoring is an open-source visualization interface developed by Thruk, designed for centrally displaying and managing system monitoring data. Versions of Thruk Monitoring prior to 2.46.3 contained a cross-site scripting vulnerability. This vulnerability stemmed from the login fields in th...

CVE-2022-23961

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface...

CVE-2022-23961

In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated remote attackers to target users of the monitoring interface...

PT-2026-38658

Name of the Vulnerable Software and Affected Versions Thruk Monitoring versions prior to 2.46.4 Description The login field of the login form is susceptible to reflected Cross-Site Scripting XSS, a flaw where an application includes untrusted data in a web page without proper validation, allowing...

CVE-2022-23961

Thruk Monitoring, an open-source visualization interface, is vulnerable to reflected Cross-Site Scripting (XSS) in the login field of the login form in versions prior to 2.46.4 . This flaw occurs because the application includes untrusted data in a web page without proper validation, allowing una...

CVE-2024-39915

Thruk is a multibackend monitoring webinterface for Naemon, Nagios, Icinga and Shinken using the Livestatus API. This authenticated RCE in Thruk allows authorized users with network access to inject arbitrary commands via the URL parameter during PDF report generation. The Thruk web application...

EUVD-2021-22131

Malware in sbrugna...

EUVD-2021-22132

Malware in sbrugna...

EUVD-2024-21270

Malicious code in bioql PyPI...

EUVD-2024-38297

Malicious code in bioql PyPI...

CVE-2024-23822

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as...

CVE-2023-34096

Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file panorama.pm is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write...

CVE-2021-35489

Thruk 2.40-2 allows /thruk/cgi-bin/extinfo.cgi?type=2=HOSTNAME=SERVICENAME=BACKEND Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browses the page containing...