CVE-2018-18247

Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...

CVE-2018-18247

Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...

CVE-2018-18249

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

CVE-2018-18250

Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item...

CVE-2018-18248

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

CVE-2018-18246

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

PT-2018-14379

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue is related to a security problem where an attacker can execute malicious scripts on a user's browser, potentially leading to unauthorized actions. This is achieved through the...

CVE-2018-18248: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...

CVE-2018-18246: Cross-Site Request Forgery (CSRF)

Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module...

PT-2018-14378

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue allows for CSRF attacks, potentially enabling an attacker to disable the monitoring module or enable the setup module without proper authorization. This can be achieved through specifi...

PT-2018-14382

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue allows parameters to break navigation dashlets. For example, using a single '$' character as the Name of a Navigation item can cause the problem. Recommendations For versions prior to...

CVE-2018-18250: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item...

CVE-2018-18249: Improper Control of Generation of Code

Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send information to the attacker, such as a name=$PATH$APACHERUNDIR$APACHERUNUSER parameter to /icingaweb2/navigation/add or /icingaweb2/dashboard/new-dashlet...

PT-2018-14381

Name of the Vulnerable Software and Affected Versions Icinga Web 2 versions prior to 2.6.2 Description The issue allows for the injection of PHP ini-file directives through environment variables. This can be achieved by sending specific information to the attacker, such as using a name parameter...

CVE-2018-18247: Improper Neutralization of Input During Web Page Generation

Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...

PT-2018-14380

Name of the Vulnerable Software and Affected Versions Icinga Web 2 affected versions not specified Description The issue is related to XSS via several API endpoints, including "/icingaweb2/monitoring/list/services" with the dir parameter, "/icingaweb2/user/list" with the query string,...

Icinga Web 2 Detection (HTTP)

HTTP based detection of Icinga Web 2. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Microsoft XML Core Services Remote Code Execution Vulnerabilities (2756145)

This host is missing a critical security update according to Microsoft Bulletin MS13-002. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MS12-043: Description of the security update for XML Core Services 5.0 when it is installed together with Office 2007, Office Compatibility Pack, Office Word Viewer, Expression Web, or Expression Web 2: August 14, 2012

None None...

PT-2009-4908 · Microsoft · Works +26

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer version 6 SP1 Windows XP versions SP2 and SP3 Office XP version SP3 Office 2003 version SP3 2007 Microsoft Office System versions SP1 and SP2 Office Project 2002 version SP1 Visio 2002 version SP2 Office Word Viewe...