Cross site scripting

Thruk 2.40-2 allows /thruk/cgi-bin/extinfo.cgi?type=2&host=HOSTNAME&service=SERVICENAME&backend=BACKEND Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browse...

CVE-2021-35489

Thruk 2.40-2 allows /thruk/cgi-bin/extinfo.cgi?type=2&host=HOSTNAME&service=SERVICENAME&backend=BACKEND Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browse...

CVE-2021-35488

Thruk 2.40-2 allows /thruk/cgi-bin/status.cgi?style=combined&title=TITLE Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it...

CVE-2021-35488

Thruk 2.40-2 contains a Cross‑Site Scripting vulnerability in /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE]. The host/title parameter can reflect arbitrary JavaScript, executed in the context of an authenticated user when they view the affected page. This is documented by multiple conne...

CVE-2021-35488

Thruk 2.40-2 allows /thruk/cgi-bin/status.cgi?style=combined&title=TITLE Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it...

CVE-2021-35489

CVE-2021-35489 affects Thruk 2.40-2. It is a reflected XSS in extinfo.cgi via the host or service parameter (type=2, host, service, backend). An authenticated user loading the page can trigger arbitrary JavaScript. The exploit details, affected version, and root cause are stated in public records...

CVE-2021-35489

Thruk 2.40-2 allows /thruk/cgi-bin/extinfo.cgi?type=2&host=HOSTNAME&service=SERVICENAME&backend=BACKEND Reflected XSS via the host or service parameter. An attacker could inject arbitrary JavaScript into extinfo.cgi. The malicious payload would be triggered every time an authenticated user browse...

Thruk 跨站脚本漏洞

Thruk is an open source multi-backend monitoring web interface from the individual developer Sven Nierlein in Germany. Thruk 2.40-2 suffers from a security vulnerability that allows an attacker to inject arbitrary JavaScript into status.cgi, which triggers a payload every time an authenticated us...

Thruk 跨站脚本漏洞

Thruk is an open source multi-backend monitoring web interface by Sven Nierlein, an individual developer in Germany. Thruk suffers from a cross-site scripting vulnerability that stems from reflective XSS via host or service parameters. An attacker can inject arbitrary JavaScript into extinfo.cgi....