Sql injection

A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings...

Cross site scripting

A Cross-site scripting XSS vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means t...

Sql injection

A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/bannermessage-ajaxhelper.php...

PT-2023-7770 · Nagios · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the use of hardcoded credentials in a monitoring tool. Exploitation of this issue may allow an attacker to read, modify, or delete data, execute arbitrary code, or...

PT-2023-7769 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the storage of credentials in plaintext, which could allow an attacker to gain unauthorized access to credentials for third-party hosts from encrypted Ansible file...

PT-2023-7761 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the graphtemplates.php script in Nagios XI, which is vulnerable due to errors in handling the dir parameter. This can allow a remote attacker to read, modify, or...

Nagios XI SQL Injection Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI version 5.11.1 and earlier, which originated from a...

PT-2023-7768 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the backup xi.sh script in Nagios XI, which is vulnerable due to uncontrolled recursion when processing the name and rootdir parameters. This could allow a remote...

PT-2023-7762 · Nagios · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the unencrypted storage of credentials in the config.inc.php script of the Nagios XI monitoring tool. This could allow a remote attacker to gain unauthorized acces...

PT-2023-7784 · Nagios · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the lack of protection for the web page structure in the Nagios XI monitoring tool. This can be exploited by a remote attacker to perform a CSRF attack...

CVE-2023-40931

Nagios XI (version 5.11.0–5.11.1) contains a SQL injection in the POST parameter ID to /nagiosxi/admin/banner_message-ajaxhelper.php, exploitable by authenticated users to run arbitrary SQL commands. Public PoCs exist (e.g., GitHub exploits) and Nessus/Nuclei templates reference this CVE. Remedia...

PT-2023-7767 · Nagios · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the send to nls.php script in Nagios XI, which improperly handles log output. This could allow an attacker to disclose protected information and elevate their...

CVE-2023-40933

A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the updatebannermessage function...

Nagios XI Cross-Site Scripting Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A cross-site scripting vulnerability exists in Nagios XI 5.11.1 and earlier versions, which originates fro...

CVE-2023-40933

Nagios XI is affected by CVE-2023-40933: a SQL injection in the update_banner_message() path that can be triggered by supplying an attacker-authenticated user with banner-configuration privileges via the ID parameter. The issue is reported for Nagios XI versions 5.11.1 and earlier. The vulnerabil...

PT-2023-7871 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the Custom Includes module of Nagios XI, which is vulnerable to unrestricted file upload of dangerous types. This could allow a remote attacker to execute arbitrar...

CVE-2023-40934

CVE-2023-40934 affects Nagios XI 5.11.1 and earlier, where an SQL injection via the Core Configuration Manager’s host escalation notification settings is possible for authenticated users with privileges to manage host escalations. Root cause: improper handling of SQL in the host escalation config...

CVE-2023-40933

A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the updatebannermessage function...

CVE-2023-40934

A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings...

CVE-2023-40934

A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings...