Debian DLA-732-3 : monit regression update

The update for monit issued as DLA-732-1 causes monit to segfault when using the collector function meant to provide data to M/Monit. This update fixes the regression. For reference the original advisory text follows. Adith Sudhakar discovered a cross-site request forgery CSRF issue in monit, a...

[SECURITY] [DLA 732-1] monit security update

Package : monit Version : 5.4-2+deb7u1 CVE ID : CVE-2016-7067 Adith Sudhakar discovered a cross-site request forgery CSRF issue in monit, a utility for monitoring hosts and services. An attacker could cause an authenticated admin to change monitoring for hosts/services through a forged link. This...

DLA-732-1 monit - security update

Bulletin has no description...

openSUSE Security Update : monit (openSUSE-2016-1339) (POODLE)

This update for monit fixes the following issues : - CVE-2016-7067: A malicious attacker could have used a cross-site request forgery vulnerability to trick an authenticated user to perform monit actions. Monit was updated to 5.20, containing all upstream improvements and bug fixes. The following...

MGASA-2016-0375 Updated monit packages fix security vulnerability

The forms in Monit's Service Manager are vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host, disable/enable monitoring for a specific service CVE-2016-7067...

Updated monit packages fix security vulnerability

The forms in Monit's Service Manager are vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host, disable/enable monitoring for a specific service CVE-2016-7067...

Tildeslash Monit Service Manager Cross-Site Request Forgery Vulnerability

Tildeslash Monit is the Norwegian company Tildeslash's set of open source for the management and monitoring of Unix system applications . Monit Service Manager is one of the service management component . A cross-site request forgery vulnerability exists in Tildeslash Monit Service Manager versio...

openSUSE Security Update : monit (openSUSE-2016-732)

This update for monit fixes the following issues : - boo974763: disable SSLv3 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2016-732. The text description of this plugin is C SUSE...

Vulnerabilities of the Gentoo Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the monit package up to version 4.1 inclusive of the Gentoo Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

CVE-2014-6409

Cross-site request forgery CSRF vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update...

Design/Logic Flaw

M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via the fullname and password parameters, a different vulnerability than CVE-2014-6409...

CVE-2014-6409

Cross-site request forgery CSRF vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update...

CVE-2014-6607

M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via the fullname and password parameters, a different vulnerability than CVE-2014-6409...

CVE-2014-6607

CVE-2014-6607 affects M/Monit 3.3.2 and earlier. The issue is a CSRF vulnerability where an attacker can change any user’s password via the fullname and password parameters to /admin/users/update because the application does not verify the original password before changing it. Impact is remote co...

CVE-2014-6409

CVE-2014-6409 is a CSRF vulnerability in M/Monit 3.3.2 and earlier. The issue allows an attacker to hijack administrator sessions and trigger password changes by submitting requests to /admin/users/update with fullname and password parameters. The root cause is lack of sufficient CSRF protection ...

M/Monit 3.3.2 - CSRF Vulnerability

No description provided by source. Vulnerability title: M/Monit CSRF Author: Dolev Farhi Contact: dolevf at openflare dot com @dolevff Application: M/Monit 3.2.2 Date: 13.9.2014 Relevant CVEs: N/A Vulnerable version: = 3.2.2 Fixed version: N/A 1. About the application ------------------------ Eas...

M/Monit 3.2.2 Cross Site Request Forgery Vulnerability

M/Monit versions 3.2.2 and below suffer from multiple cross site request forgery vulnerabilities. Application: M/Monit 3.2.2 Author: Dolev Farhi @dolevff Date: 13.9.2014 Relevant CVEs: CVE-2014-6409, CVE-2014-6607 Vulnerable version: CSRF poc M/monit 3. Mitigation Software vendor confirmed the...

MMonit 3.3.2 - Cross-Site Request Forgery

MMonit 3.3.2 - Cross-Site Request Forgery Vulnerability title: M/Monit CSRF Author: Dolev Farhi Contact: dolevf at openflare dot com @dolevff Application: M/Monit 3.2.2 Date: 13.9.2014 Relevant CVEs: N/A Vulnerable version: CSRF PoC for M/monit input type="hidden...

M/Monit 3.3.2 - Cross-Site Request Forgery

Vulnerability title: M/Monit CSRF Author: Dolev Farhi Contact: dolevf at openflare dot com @dolevff Application: M/Monit 3.2.2 Date: 13.9.2014 Relevant CVEs: N/A Vulnerable version: CSRF PoC for M/monit input type="hidden" name="uname" value=...