Thruk 2.40-2 - Cross-Site Scripting Detection

Thruk 2.40-2 contains a cross-site scripting vulnerability via /thruk/cgi-bin/status.cgi?style=combined&title=TITLE in the host or title parameter. An attacker can inject arbitrary JavaScript into status.cgi, leading to a triggered payload when accessed by an authenticated user. !/usr/bin/env...

PT-2021-20928

Name of the Vulnerable Software and Affected Versions: Thruk versions 2.40 through 2 Description: The issue allows for Reflected XSS via the host or title parameter in the "/thruk/cgi-bin/status.cgi" endpoint. An attacker could inject arbitrary JavaScript into status.cgi, which would be triggered...

CVE-2015-8010

Cross-site scripting XSS vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi...

CVE-2015-8010: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi...

PT-2017-7311

Name of the Vulnerable Software and Affected Versions Icinga versions prior to 1.14 Description The issue is related to a cross-site scripting XSS vulnerability in the Classic-UI, specifically with the CSV export link and pagination feature. This allows remote attackers to inject arbitrary web...