Filtered by vendor Nagios Subscriptions
Total 176 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-36365 1 Nagios 1 Nagios Xi 2024-11-21 9.8 Critical
Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.
CVE-2021-36364 1 Nagios 1 Nagios Xi 2024-11-21 9.8 Critical
Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.
CVE-2021-36363 1 Nagios 1 Nagios Xi 2024-11-21 9.8 Critical
Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.
CVE-2021-35479 1 Nagios 1 Log Server 2024-11-21 5.4 Medium
Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page.
CVE-2021-35478 1 Nagios 1 Log Server 2024-11-21 5.4 Medium
Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.
CVE-2021-33179 1 Nagios 1 Nagios Xi 2024-11-21 6.1 Medium
The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload.
CVE-2021-33177 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries.
CVE-2021-28925 1 Nagios 1 Network Analyzer 2024-11-21 9.8 Critical
SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/.
CVE-2021-28924 1 Nagios 1 Network Analyzer 2024-11-21 6.1 Medium
Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.
CVE-2021-26024 1 Nagios 2 Favorites, Nagios Xi 2024-11-21 5.3 Medium
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account.
CVE-2021-26023 1 Nagios 2 Favorites, Nagios Xi 2024-11-21 6.1 Medium
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.
CVE-2021-25299 1 Nagios 1 Nagios Xi 2024-11-21 6.1 Medium
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.
CVE-2021-25298 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
CVE-2021-25297 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
CVE-2021-25296 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
CVE-2020-6586 1 Nagios 1 Nagios 2024-11-21 5.4 Medium
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
CVE-2020-6585 1 Nagios 1 Nagios 2024-11-21 8.8 High
Nagios Log Server 2.1.3 has CSRF.
CVE-2020-6584 1 Nagios 1 Nagios 2024-11-21 6.5 Medium
Nagios Log Server 2.1.3 has Incorrect Access Control.
CVE-2020-6582 2 Fedoraproject, Nagios 2 Fedora, Remote Plug In Executor 2024-11-21 7.5 High
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
CVE-2020-6581 2 Fedoraproject, Nagios 2 Fedora, Remote Plug In Executor 2024-11-21 7.3 High
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.