Filtered by vendor Nagios
Subscriptions
Total
176 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-37223 | 1 Nagios | 1 Nagios Xi | 2024-08-04 | 6.5 Medium |
| Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files. | ||||
| CVE-2021-37346 | 1 Nagios | 1 Nagios Xi Watchguard Wizard | 2024-08-04 | 9.8 Critical |
| Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection). | ||||
| CVE-2021-37352 | 1 Nagios | 1 Nagios Xi | 2024-08-04 | 6.1 Medium |
| An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link. | ||||
| CVE-2021-37349 | 1 Nagios | 1 Nagios Xi | 2024-08-04 | 7.8 High |
| Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database. | ||||
| CVE-2021-36366 | 1 Nagios | 1 Nagios Xi | 2024-08-04 | 9.8 Critical |
| Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards. | ||||
| CVE-2021-36364 | 1 Nagios | 1 Nagios Xi | 2024-08-04 | 9.8 Critical |
| Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards. | ||||
| CVE-2021-36365 | 1 Nagios | 1 Nagios Xi | 2024-08-04 | 9.8 Critical |
| Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh. | ||||
| CVE-2021-36363 | 1 Nagios | 1 Nagios Xi | 2024-08-04 | 9.8 Critical |
| Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php. | ||||
| CVE-2021-35479 | 1 Nagios | 1 Log Server | 2024-08-04 | 5.4 Medium |
| Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page. | ||||
| CVE-2021-35478 | 1 Nagios | 1 Log Server | 2024-08-04 | 5.4 Medium |
| Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page. | ||||
| CVE-2021-33179 | 1 Nagios | 1 Nagios Xi | 2024-08-03 | 6.1 Medium |
| The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload. | ||||
| CVE-2021-33177 | 1 Nagios | 1 Nagios Xi | 2024-08-03 | 8.8 High |
| The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries. | ||||
| CVE-2021-28924 | 1 Nagios | 1 Network Analyzer | 2024-08-03 | 6.1 Medium |
| Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page. | ||||
| CVE-2021-28925 | 1 Nagios | 1 Network Analyzer | 2024-08-03 | 9.8 Critical |
| SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/. | ||||
| CVE-2021-26023 | 1 Nagios | 2 Favorites, Nagios Xi | 2024-08-03 | 6.1 Medium |
| The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS. | ||||
| CVE-2021-26024 | 1 Nagios | 2 Favorites, Nagios Xi | 2024-08-03 | 5.3 Medium |
| The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account. | ||||
| CVE-2021-25299 | 1 Nagios | 1 Nagios Xi | 2024-08-03 | 6.1 Medium |
| Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server. | ||||
| CVE-2021-25296 | 1 Nagios | 1 Nagios Xi | 2024-08-03 | 8.8 High |
| Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. | ||||
| CVE-2021-25298 | 1 Nagios | 1 Nagios Xi | 2024-08-03 | 8.8 High |
| Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. | ||||
| CVE-2021-25297 | 1 Nagios | 1 Nagios Xi | 2024-08-03 | 8.8 High |
| Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. | ||||