195 matches found
Session-Persistence-After-Enabling-2FA-CVE-2025-60425
2FA有効化後のセッション永続性 概要 Nagios Fusionアプリケーション（バージョン2024R1.2および2024R2）には、2要素認証（2FA）を有効にした後でも既存のセッションが有効のままになるという重大なセキュリティ上の欠陥が存在します。具体的には、管理者アカウントで2FAを有効にした場合、アプリケーションは2FA有効化より前に確立されたすべてのアクティブセッションを無効化できません。これにより、古いセッションにアクセスできる攻撃者または不正ユーザーが2FA機構をバイパスし、不正な操作を実行できるようになります。 以下の問題が確認されました：...
2FA-Bypass-using-a-Brute-Force-Attack-CVE-2025-60424
ブルートフォース攻撃による2FAバイパス 概要 Nagios Fusionアプリケーション（バージョン2024R1.2および2024R2）は、二要素認証（2FA）メカニズムに対するブルートフォース攻撃に対して脆弱です。具体的には、2FAの実装はレート制限やアカウントロックアウトのメカニズムを適切に適用しておらず、攻撃者がワンタイムパスワード（OTP）を繰り返し推測することで2FAをバイパスできる可能性があります。 以下の問題が確認されました: レート制限の欠如 : 2FAエンドポイントはOTP送信試行回数を制限しません。 ロックアウトポリシーの不備 :...
CVE-2018-12501
Nagios Fusion before 4.1.4 has XSS, aka TPS13332-13335...
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure working conditions lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure’s operational status is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure operating status lies in its insufficient attempt-limiting mechanism, which allows attackers to circumvent existing security restrictions.
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure’s operating status is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure working conditions lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary code.
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure’s operational status is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code when a user clicks on a specially crafte...
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure working conditions lies in the lack of protective measures for the website structure. This allows attackers to perform cross-site scripting attacks (XSS).
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure’s operational status is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure working conditions lies in the incorrect expiration time of the session. This allows attackers to gain unauthorized access to protected information.
The vulnerability of the Nagios Fusion software for visualizing IT infrastructure operating status is related to an incorrect session duration. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...
CVE-2023-53690
Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting XSS vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views th...
CVE-2018-25119
Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting XSS via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2023-53689
Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting XSS vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly...
CVE-2023-7312
Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting XSS vulnerability when adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affecte...
CVE-2017-20209
Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting XSS via the Users and Servers pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2025-34249
Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication 2FA implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try...
CVE-2025-34269
Nagios Fusion versions prior to R2.1 contain a vulnerability due to the application not requiring re-authentication or session rotation when a user has enabled two-factor authentication 2FA. As a result, an adversary who has obtained a valid session could continue using the active session after t...
EUVD-2025-37224
Nagios Fusion versions prior to R2.1 contain a vulnerability due to the application not requiring re-authentication or session rotation when a user has enabled two-factor authentication 2FA. As a result, an adversary who has obtained a valid session could continue using the active session after t...
EUVD-2025-37225
Nagios Fusion versions prior to 2024R2.1 contain a brute-force bypass in the Two-Factor Authentication 2FA implementation. The application did not properly enforce rate limiting or account lockout for repeated failed 2FA verification attempts, allowing a remote attacker to repeatedly try...
EUVD-2018-21610
Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting XSS via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
EUVD-2017-18925
Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting XSS via the Users and Servers pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
