PT-2018-13426

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions prior to 5.3.1 Opsview Monitor versions 5.4.x prior to 5.4.2 Description The issue concerns the diagnosticsb2ksy parameter of the "/rest" endpoint, which is susceptible to Cross-Site Scripting. Recommendations For...

PT-2018-13424

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions 5.4.x through 5.4.1 Description The issue affects the web management console, where an authenticated administrator can exploit a command injection flaw due to improper sanitization of the value parameter. This allows f...

Opsview Monitor Cross-Site Scripting Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a cross-site scripting vulnerability that can be exploited by ...

Opsview Monitor Command Execution Vulnerability (CNVD-2018-17452)

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor has a command execution vulnerability that allows an attacker to gain acces...

Opsview Monitor Command Execution Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor has a command execution vulnerability that allows an attacker to gain acces...

PT-2018-13422

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions prior to 5.3.1 Opsview Monitor versions 5.4.x prior to 5.4.2 Description The issue arises from improper sanitization of the rancid password parameter in the test connection functionality of the NetAudit section, leadin...

Opsview Monitor Cross-Site Scripting Vulnerability (CNVD-2018-17454)

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a cross-site scripting vulnerability that can be exploited by ...

PT-2018-13423

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions prior to 5.3.1 Opsview Monitor versions 5.4.x prior to 5.4.2 Description The issue concerns the /etc/init.d/opsview-reporting-module script, which runs at boot time and invokes a file editable by the nagios user. This...

Opsview Monitor Local Elevation of Privilege Vulnerability

Opsview Monitor is a virtual appliance designed to be deployed in an organization's network infrastructure. It is bundled with a Web management console for monitoring and managing hosts and their services. Opsview Monitor suffers from a local elevation of privilege vulnerability that allows an...

OpsView Monitor Detection

Detection of OpsView Monitor. The script sends a connection request to the server and attempts to detect OpsView Monitor and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

CVE-2018-16148: Improper Neutralization of Input During Web Page Generation

The diagnosticsb2ksy parameter of the /rest endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting...

CVE-2018-16147: Improper Neutralization of Input During Web Page Generation

The data parameter of the /settings/api/router endpoint in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to Cross-Site Scripting...

CVE-2018-16146: Improper Neutralization of Special Elements used in an OS Command

The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized, leading to arbitrary command injection wi...

CVE-2018-16144: Improper Neutralization of Special Elements used in an OS Command

The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command injection due to improper sanitization of the rancidpassword parameter...

CVE-2018-16145: Incorrect Permission Assignment for Critical Resource

The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited by the nagios user, and would allow attackers to elevate their privileges to root after a system restart, hence obtaining full control of...

PT-2018-13425

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions prior to 5.3.1 Opsview Monitor versions 5.4.x prior to 5.4.2 Description The issue concerns the /settings/api/router endpoint, where the data parameter is vulnerable to Cross-Site Scripting. Recommendations For version...

Multiple Remote Code-Execution Flaws Patched in Opsview Monitor

A slew of vulnerabilities have been disclosed in Opsview Monitor a proprietary IT monitoring software for networks and applications, which could enable remote code-execution, command-execution and local privilege-escalation. A total of five flaws CVE-2018-16148, CVE-2018-16147, CVE-2018-16146,...

Opsview Monitor Multiple Vulnerabilities

Advisory ID Internal CORE-2018-0008 1. Advisory Information Title: Opsview Monitor Multiple Vulnerabilities Advisory ID: CORE-2018-0008 Advisory URL:https://www.coresecurity.com/core-labs/advisories/opsview-monitor-multiple-vulnerabilities Date published: 2018-09-04 Date of last update: 2018-09-0...

WordPress Plainview Activity Monitor plugin <= 20161228 - Remote Command Execution (RCE) vulnerability

Remote Command Execution RCE vulnerability found by "aas" in WordPress Plainview Activity Monitor plugin versions = 20161228. Solution Update the WordPress Plainview Activity Monitor plugin to the latest available version at least 20180826...

WordPress Plainview Activity Monitor 20161228 Plugin - Command Injection Exploit

Exploit for php platform in category web applications !-- Wordpress Plainview Activity Monitor RCE + Version: 20161228 and possibly prior + Description: Combine OS Commanding and CSRF to get reverse shell + Author: LydAcric LEFEBVRE + CVE-ID: CVE-2018-15877...