Filtered by vendor Nagios
Subscriptions
Total
186 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-28924 | 1 Nagios | 1 Network Analyzer | 2024-11-21 | 6.1 Medium |
| Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page. | ||||
| CVE-2021-26024 | 1 Nagios | 2 Favorites, Nagios Xi | 2024-11-21 | 5.3 Medium |
| The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account. | ||||
| CVE-2021-26023 | 1 Nagios | 2 Favorites, Nagios Xi | 2024-11-21 | 6.1 Medium |
| The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS. | ||||
| CVE-2021-25299 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 6.1 Medium |
| Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server. | ||||
| CVE-2020-6586 | 1 Nagios | 1 Nagios | 2024-11-21 | 5.4 Medium |
| Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered. | ||||
| CVE-2020-6585 | 1 Nagios | 1 Nagios | 2024-11-21 | 8.8 High |
| Nagios Log Server 2.1.3 has CSRF. | ||||
| CVE-2020-6584 | 1 Nagios | 1 Nagios | 2024-11-21 | 6.5 Medium |
| Nagios Log Server 2.1.3 has Incorrect Access Control. | ||||
| CVE-2020-6582 | 2 Fedoraproject, Nagios | 2 Fedora, Remote Plug In Executor | 2024-11-21 | 7.5 High |
| Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call. | ||||
| CVE-2020-6581 | 2 Fedoraproject, Nagios | 2 Fedora, Remote Plug In Executor | 2024-11-21 | 7.3 High |
| Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection. | ||||
| CVE-2020-5796 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 7.8 High |
| Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users being able to write to and execute arbitrary PHP code with root privileges. | ||||
| CVE-2020-5792 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 7.2 High |
| Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user. | ||||
| CVE-2020-5791 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 7.2 High |
| Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user. | ||||
| CVE-2020-5790 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 6.5 Medium |
| Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link. | ||||
| CVE-2020-35578 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 7.2 High |
| An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands. | ||||
| CVE-2020-35269 | 1 Nagios | 1 Nagios Core | 2024-11-21 | 8.8 High |
| Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers. | ||||
| CVE-2020-28911 | 1 Nagios | 1 Fusion | 2024-11-21 | 6.5 Medium |
| Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php. | ||||
| CVE-2020-28910 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 9.8 Critical |
| Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getprofile.sh. | ||||
| CVE-2020-28909 | 1 Nagios | 1 Fusion | 2024-11-21 | 8.8 High |
| Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo. | ||||
| CVE-2020-28908 | 1 Nagios | 1 Fusion | 2024-11-21 | 9.8 Critical |
| Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. | ||||
| CVE-2020-28907 | 1 Nagios | 1 Fusion | 2024-11-21 | 9.8 Critical |
| Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh. | ||||