Lucene search

K

32 matches found

CVE
CVE
added 2021/02/15 1:15 p.m.1030 views

CVE-2021-25296

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS comma...

9CVSS8.8AI score0.93482EPSS
CVE
CVE
added 2021/02/15 1:15 p.m.988 views

CVE-2021-25297

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injec...

9CVSS8.8AI score0.51009EPSS
CVE
CVE
added 2021/02/15 1:15 p.m.972 views

CVE-2021-25298

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command i...

9CVSS8.8AI score0.77096EPSS
CVE
CVE
added 2021/01/13 9:15 p.m.147 views

CVE-2020-35578

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.

9CVSS6.8AI score0.90441EPSS
CVE
CVE
added 2021/08/13 12:15 p.m.113 views

CVE-2021-37350

Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.

9.8CVSS9.7AI score0.53972EPSS
CVE
CVE
added 2021/02/15 1:15 p.m.84 views

CVE-2021-25299

Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session...

6.1CVSS6.8AI score0.7993EPSS
CVE
CVE
added 2021/08/13 12:15 p.m.77 views

CVE-2021-37343

A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.

8.8CVSS8.4AI score0.80419EPSS
CVE
CVE
added 2021/02/15 6:15 p.m.66 views

CVE-2020-24899

Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.

8.8CVSS9AI score0.04923EPSS
CVE
CVE
added 2021/08/13 12:15 p.m.62 views

CVE-2021-37347

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument.

7.8CVSS8.2AI score0.00085EPSS
CVE
CVE
added 2021/08/13 12:15 p.m.61 views

CVE-2021-37349

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database.

7.8CVSS8.1AI score0.00161EPSS
CVE
CVE
added 2021/08/13 12:15 p.m.58 views

CVE-2021-37348

Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php.

7.5CVSS7.8AI score0.11694EPSS
CVE
CVE
added 2021/08/13 12:15 p.m.58 views

CVE-2021-37352

An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.

6.1CVSS6.7AI score0.03248EPSS
CVE
CVE
added 2021/06/07 10:15 p.m.57 views

CVE-2021-3277

Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.

7.2CVSS7.4AI score0.32138EPSS
CVE
CVE
added 2021/08/13 12:15 p.m.56 views

CVE-2021-37351

Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server.

5.3CVSS6.3AI score0.00583EPSS
CVE
CVE
added 2021/10/14 3:15 p.m.53 views

CVE-2021-33177

The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries.

8.8CVSS9AI score0.30647EPSS
CVE
CVE
added 2021/10/14 3:15 p.m.53 views

CVE-2021-33179

The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload.

6.1CVSS6.2AI score0.57682EPSS
CVE
CVE
added 2021/08/13 12:15 p.m.53 views

CVE-2021-37345

Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.

7.8CVSS8.8AI score0.00083EPSS
CVE
CVE
added 2021/05/24 1:15 p.m.50 views

CVE-2020-28900

Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.

10CVSS9.4AI score0.00352EPSS
CVE
CVE
added 2021/09/15 2:15 p.m.48 views

CVE-2021-38156

In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.

5.4CVSS5.1AI score0.86031EPSS
CVE
CVE
added 2021/05/24 1:15 p.m.47 views

CVE-2020-28906

Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root.

9CVSS9AI score0.00279EPSS
CVE
CVE
added 2021/09/28 5:15 p.m.45 views

CVE-2021-36365

Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.

9.8CVSS9.5AI score0.00997EPSS
CVE
CVE
added 2021/02/25 2:15 p.m.44 views

CVE-2021-3273

Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.

9CVSS7.1AI score0.24281EPSS
CVE
CVE
added 2021/05/24 1:15 p.m.43 views

CVE-2020-28910

Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getprofile.sh.

10CVSS9.4AI score0.00239EPSS
CVE
CVE
added 2021/09/28 5:15 p.m.43 views

CVE-2021-36363

Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.

9.8CVSS9.5AI score0.00997EPSS
CVE
CVE
added 2021/09/28 5:15 p.m.43 views

CVE-2021-36364

Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.

9.8CVSS9.4AI score0.10899EPSS
CVE
CVE
added 2021/10/05 12:15 p.m.42 views

CVE-2021-37223

Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can b...

6.5CVSS6.2AI score0.00685EPSS
CVE
CVE
added 2021/10/26 11:15 a.m.42 views

CVE-2021-40345

An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.

9CVSS7.3AI score0.76499EPSS
CVE
CVE
added 2021/01/26 6:16 p.m.41 views

CVE-2021-3193

Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.

9.8CVSS9.8AI score0.22602EPSS
CVE
CVE
added 2021/09/28 5:15 p.m.39 views

CVE-2021-36366

Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.

9.8CVSS9.4AI score0.10899EPSS
CVE
CVE
added 2021/10/26 11:15 a.m.39 views

CVE-2021-40344

An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.

7.2CVSS7.2AI score0.6721EPSS
CVE
CVE
added 2021/02/15 6:15 p.m.38 views

CVE-2020-22427

NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted, and the only option is ...

7.2CVSS7.4AI score0.36632EPSS
CVE
CVE
added 2021/10/26 11:15 a.m.37 views

CVE-2021-40343

An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the root user.

7.8CVSS7.6AI score0.00458EPSS