Filtered by vendor Nagios
Subscribe
Total
173 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-3277 | 1 Nagios | 1 Nagios Xi | 2021-06-15 | 6.5 MEDIUM | 7.2 HIGH |
| Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files. | |||||
| CVE-2020-28907 | 1 Nagios | 1 Fusion | 2021-06-03 | 10.0 HIGH | 9.8 CRITICAL |
| Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh. | |||||
| CVE-2020-28908 | 1 Nagios | 1 Fusion | 2021-06-03 | 7.5 HIGH | 9.8 CRITICAL |
| Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. | |||||
| CVE-2020-28909 | 1 Nagios | 1 Fusion | 2021-06-03 | 9.0 HIGH | 8.8 HIGH |
| Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo. | |||||
| CVE-2020-28911 | 1 Nagios | 1 Fusion | 2021-06-03 | 4.0 MEDIUM | 6.5 MEDIUM |
| Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php. | |||||
| CVE-2020-28900 | 1 Nagios | 2 Fusion, Nagios Xi | 2021-05-28 | 10.0 HIGH | 9.8 CRITICAL |
| Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh. | |||||
| CVE-2020-28901 | 1 Nagios | 1 Fusion | 2021-05-28 | 10.0 HIGH | 9.8 CRITICAL |
| Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php. | |||||
| CVE-2020-28902 | 1 Nagios | 1 Fusion | 2021-05-28 | 10.0 HIGH | 9.8 CRITICAL |
| Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php. | |||||
| CVE-2020-28903 | 1 Nagios | 1 Fusion | 2021-05-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS. | |||||
| CVE-2020-28904 | 1 Nagios | 1 Fusion | 2021-05-28 | 7.5 HIGH | 9.8 CRITICAL |
| Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code. | |||||
| CVE-2020-28906 | 1 Nagios | 2 Fusion, Nagios Xi | 2021-05-28 | 9.0 HIGH | 8.8 HIGH |
| Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root. | |||||
| CVE-2020-35578 | 1 Nagios | 1 Nagios Xi | 2021-04-26 | 9.0 HIGH | 7.2 HIGH |
| An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands. | |||||
| CVE-2019-15949 | 1 Nagios | 1 Nagios Xi | 2021-04-15 | 9.0 HIGH | 8.8 HIGH |
| Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root. | |||||
| CVE-2021-28925 | 1 Nagios | 1 Network Analyzer | 2021-04-13 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/. | |||||
| CVE-2021-28924 | 1 Nagios | 1 Network Analyzer | 2021-04-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page. | |||||
| CVE-2021-25299 | 1 Nagios | 1 Nagios Xi | 2021-03-04 | 4.3 MEDIUM | 6.1 MEDIUM |
| Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server. | |||||
| CVE-2020-35269 | 1 Nagios | 1 Nagios Core | 2021-03-02 | 6.8 MEDIUM | 8.8 HIGH |
| Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers. | |||||
| CVE-2021-3273 | 1 Nagios | 1 Nagios Xi | 2021-03-02 | 9.0 HIGH | 7.2 HIGH |
| Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system. | |||||
| CVE-2021-26023 | 1 Nagios | 2 Favorites, Nagios Xi | 2021-02-05 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS. | |||||
| CVE-2021-3193 | 1 Nagios | 1 Nagios Xi | 2021-02-03 | 7.5 HIGH | 9.8 CRITICAL |
| Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user. | |||||