Filtered by vendor Nagios
Subscribe
Total
173 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-25385 | 1 Nagios | 1 Log Server | 2021-01-22 | 4.3 MEDIUM | 6.1 MEDIUM |
| Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page. | |||||
| CVE-2020-5796 | 1 Nagios | 1 Nagios Xi | 2020-11-24 | 7.2 HIGH | 7.8 HIGH |
| Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users being able to write to and execute arbitrary PHP code with root privileges. | |||||
| CVE-2020-27988 | 1 Nagios | 1 Nagios Xi | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). | |||||
| CVE-2020-27989 | 1 Nagios | 1 Nagios Xi | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). | |||||
| CVE-2020-27990 | 1 Nagios | 1 Nagios Xi | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). | |||||
| CVE-2020-27991 | 1 Nagios | 1 Nagios Xi | 2020-11-17 | 3.5 LOW | 5.4 MEDIUM |
| Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). | |||||
| CVE-2020-5790 | 1 Nagios | 1 Nagios Xi | 2020-10-21 | 4.3 MEDIUM | 6.5 MEDIUM |
| Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link. | |||||
| CVE-2018-10554 | 1 Nagios | 1 Nagios Xi | 2020-08-24 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime.php, related to the update_pages function; (3) the ajaxhelper.php opts or background parameter; (4) the i[] array parameter to ajax_handler.php; or (5) the deploynotification.php title parameter. | |||||
| CVE-2018-18245 | 2 Debian, Nagios | 2 Debian Linux, Nagios Core | 2020-04-11 | 3.5 LOW | 5.4 MEDIUM |
| Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE. | |||||
| CVE-2018-13458 | 1 Nagios | 1 Nagios Core | 2020-04-11 | 4.3 MEDIUM | 5.5 MEDIUM |
| qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. | |||||
| CVE-2018-13457 | 1 Nagios | 1 Nagios Core | 2020-04-11 | 4.3 MEDIUM | 5.5 MEDIUM |
| qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. | |||||
| CVE-2018-13441 | 1 Nagios | 1 Nagios | 2020-04-11 | 2.1 LOW | 5.5 MEDIUM |
| qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. | |||||
| CVE-2020-10821 | 1 Nagios | 1 Nagios Xi | 2020-03-23 | 3.5 LOW | 4.8 MEDIUM |
| Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter. | |||||
| CVE-2020-10820 | 1 Nagios | 1 Nagios Xi | 2020-03-23 | 3.5 LOW | 4.8 MEDIUM |
| Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter. | |||||
| CVE-2020-10819 | 1 Nagios | 1 Nagios Xi | 2020-03-23 | 3.5 LOW | 4.8 MEDIUM |
| Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter. | |||||
| CVE-2019-20197 | 1 Nagios | 1 Nagios Xi | 2020-01-07 | 9.0 HIGH | 8.8 HIGH |
| In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account. | |||||
| CVE-2019-20139 | 1 Nagios | 1 Nagios Xi | 2020-01-03 | 3.5 LOW | 5.4 MEDIUM |
| In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user. | |||||
| CVE-2018-15711 | 1 Nagios | 1 Nagios Xi | 2019-10-03 | 6.5 MEDIUM | 8.8 HIGH |
| Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges. | |||||
| CVE-2017-14312 | 1 Nagios | 1 Nagios Core | 2019-10-03 | 7.2 HIGH | 7.8 HIGH |
| Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and similarly can have nagios.cfg owned by a non-root account), which allows local users to gain privileges by leveraging access to this non-root account. | |||||
| CVE-2018-15710 | 1 Nagios | 1 Nagios Xi | 2019-10-03 | 7.2 HIGH | 7.8 HIGH |
| Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. | |||||