CVE-2012-6096

Removed by vendor...

CVE-2012-6096

Multiple stack-based buffer overflows in the gethistory function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long 1 hostname variable host parameter or 2...

CVE-2012-6096

CVE-2012-6096 describes multiple stack-based buffer overflows in Nagios Core before 3.4.4 and Icinga 1.6.x/1.7.x/1.8.x before respective fixed points, exploitable via a long host_name (host) or svc_description parameter in history.cgi get_history. Evidence in connected docs shows public disclosur...

[BSA-079] Security Update for icinga

Jan Wagner uploaded new packages for icinga which fixed the following security problems: CVE-2012-6096 CGI buffer overflows https://security-tracker.debian.org/tracker/CVE-2012-6096 For the squeeze-backports distribution the problems have been fixed in version 1.7.1-5bpo60+1 of the icinga package...

CVE-2012-3441

The database creation script module/idoutils/db/scripts/createmysqldb.sh in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors...

CVE-2012-3441

The database creation script module/idoutils/db/scripts/createmysqldb.sh in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors...

Design/Logic Flaw

The database creation script module/idoutils/db/scripts/createmysqldb.sh in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors...

CVE-2012-3441

Removed by vendor...

CVE-2012-3441

CVE-2012-3441 concerns Icinga 1.7.1 where the database creation script (module/idoutils/db/scripts/create_mysqldb.sh) grants the icinga user access to all databases. This explicit action enables icinga users to access other databases via unspecified vectors, per multiple connected sources (NVD, S...

CVE-2012-3441

The database creation script module/idoutils/db/scripts/createmysqldb.sh in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors...

CVE-2011-2477

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escapehtmltags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a...

CVE-2011-2179

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...

CVE-2011-2477

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escapehtmltags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escapehtmltags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a...

CVE-2011-2477

Removed by vendor...

CVE-2011-2477

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escapehtmltags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a...

CVE-2011-2477

CVE-2011-2477 describes multiple XSS vulnerabilities in config.c/config.cgi in Nagios/Icinga before 1.4.1 when escape_html_tags is disabled. The issue enables remote injection of script/HTML via inputs affecting the web interface (e.g., an expanded parameter or onload behavior in a BODY tag after...

CVE-2011-2179

Removed by vendor...

CVE-2011-2179

CVE-2011-2179 is an XSS vulnerability in Nagios (config.cgi) via the expand parameter affecting Nagios 3.2.3 and Icinga

CVE-2011-2179

Multiple cross-site scripting XSS vulnerabilities in config.c in config.cgi in 1 Nagios 3.2.3 and 2 Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an a command action or a b hosts action...