21 matches found
CVE-2019-15898
Nagios Log Server prior to 2.0.8 is affected by a reflected XSS vulnerability on the login page via the username field. The issue is confirmed across multiple sources (NVD/Red Hat entry). No explicit remediation steps or patch details are described in the provided documents beyond noting the affe...
CVE-2020-16157
Nagios Log Server (versions prior to 2.1.7) contains a Stored XSS vulnerability exploitable via the Notification Methods → Email Users menu. The root cause is insufficient input validation in the web application, allowing injected scripts to be stored and later executed in the admin/user context....
CVE-2021-35479
CVE-2021-35479 affects Nagios Log Server prior to version 2.1.9, where a Stored XSS vulnerability exists in the custom column view of the alert history and audit log via the affected pp parameter. Exploitation is described as requiring a crafted link or a third‑party webpage to trigger the vulner...
CVE-2021-35478
CVE-2021-35478 and CVE-2021-35479 pertain to Nagios Log Server prior to 2.1.9. The CVE-2021-35478 entry describes a Reflected XSS in the dropdown for the alert history and audit log filtering parameters, exploitable when a user opens a crafted link or third‑party page. The CVE-2021-35479 entry de...
CVE-2025-34323
Nagios Log Server is vulnerable in versions prior to 2026R1.0.1 due to an unsafe interaction between passwordless sudo rules and group-writable script directories. The www-data user is in the nagios group, which has write access to /usr/local/nagioslogserver/scripts, while scripts in that directo...
CVE-2025-44823
Nagios Log Server (before 2024R1.3.2) is vulnerable: unauthenticated? No—authenticated users with access to the API can call /nagioslogserver/index.php/api/system/get_users to retrieve cleartext admin API keys. The underlying issue exposes user accounts and API keys, enabling full system compromi...
CVE-2025-34298
Nagios Log Server (prior to 2024R1.3.2) contains a privilege escalation in the account email-change workflow. An attacker could set their own email to an invalid value, and due to insufficient validation and authorization checks tied to email identity state, trigger an inconsistent account state ...
CVE-2025-44824
Nagios Log Server prior to 2024R1.3.2 is affected by CVE-2025-44824. An authenticated user with read-only API access can call /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch to stop Elasticsearch. The API reportedly returns could not stop elasticsearch, yet the service stops, e...
CVE-2025-34322
Nagios Log Server (before 2026R1.0.1) is affected by an authenticated command-injection in the experimental Natural Language Queries feature. The issue arises when user-controlled settings (including model selection and connection parameters) are read from global configuration and concatenated in...
CVE-2025-34273
CVE-2025-34273 concerns Nagios Log Server prior to 2024R2.0.3, where an incorrect authorization check in the global dashboard deletion workflow allows non-administrator users to delete dashboards, potentially affecting other users and the monitoring UI. Affected product: Nagios Log Server; vulner...
CVE-2020-36858
Nagios Log Server is affected by a cross-site scripting (XSS) vulnerability in versions prior to 2.1.6, exposed via the web interface on Create User, Edit User, and Manage Host Lists pages. The root cause is insufficient validation/escaping of user-supplied input, allowing an attacker to inject a...
CVE-2024-58273
CVE-2024-58273 affects Nagios Log Server prior to 2024R1.0.2. The vulnerability enables local privilege escalation when an attacker can run commands as the Apache web user (or backend shell user), escalating to root on the host. Red Hat and related sources corroborate the LPE exposure in affected...
CVE-2025-34272
Nagios Log Server (pre-2024R2.0.3) has a defect where deleting a user’s configured default dashboard may not fall back reliably to an empty default dashboard, potentially showing an unintended default view. This can lead to information exposure or unintended privilege exposure depending on dashbo...
CVE-2025-34277
CVE-2025-34277 affects Nagios Log Server versions prior to 2024R1.3.1, where a code injection vulnerability arises from inadequate validation of dashboard ID values forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to execute attacker-contro...
CVE-2025-34271
Nagios Log Server (prior to 2024R2.0.2) suffers a cluster manager credential leakage vulnerability: credentials requested from peer nodes over an unencrypted channel, even with SSL/TLS enabled. This allows an on-path attacker to intercept credentials in transit and potentially authenticate as a c...
CVE-2016-15049
Nagios Log Server is affected by an XSS vulnerability in the Dashboards section, specifically when rendering log entries in the Logs table. Affected products are Nagios Log Server versions prior to 1.4.2; untrusted log content was not safely encoded for the output context, allowing attacker-contr...
CVE-2023-7323
CVE-2023-7323 affects Nagios Log Server prior to 2024R1, with an XSS vulnerability caused by insufficient validation/escaping of user input in the Create User function. The impact is potential arbitrary script execution in a victim’s browser. Publicly disclosed details across Red Hat, EUVD, and v...
CVE-2025-34270
CVE-2025-34270 affects Nagios Log Server versions prior to 2024R2.0.2, where the AD/LDAP user import path does not obfuscate the password field. The result is potential exposure of plaintext passwords for imported accounts in the user interface, logs, or other diagnostic output. The Red Hat and E...
CVE-2025-34274
Nagios Log Server (pre-2024R2.0.3) contains an execution with unnecessary privileges due to embedding a Logstash process running as root. If an attacker compromises Logstash (e.g., via insecure plugins, pipeline config injection, or input parsing vulnerabilities), they could execute code with roo...
CVE-2023-7322
Affected software: Nagios Log Server, versions prior to 2024R1. Vulnerability: incorrect authorization in API handling could allow authenticated but non-privileged users to read or modify resources via the API beyond their rights. Root cause: insufficient authorization checks on API endpoints. Im...