Mmonit vulnerabilities
4 vulnerabilities
Known vulnerabilities in Mmonit products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2RoutineCVE-2019-11454canonical · ubuntu_linux +6 morecanonical ubuntu_linuxPersistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticated attacker to introduce arbitrary JavaScript via manipulation of an unsanitized user field of the Authorization header for HTTP Basic Authentication, which is mishandled during an _viewlog operation.CVSS6.1MediumEPSS2.41%RoutineCVE-2016-7067tildeslash ltd. · monit +4 moretildeslash ltd. monitMonit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host or disable/enable monitoring for a specific service.CVSS6.5MediumEPSS0.88%PrioritiseCVE-2014-6607mmonit · m\/monitmmonit m\/monitM/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via the fullname and password parameters, a different vulnerability than CVE-2014-6409.CVSS7.5HighEPSS6.65%RoutineCVE-2014-6409mmonit · m\/monitmmonit m\/monitCross-site request forgery (CSRF) vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update.CVSS6.8MediumEPSS2.27%