Nagios vulnerabilities
303 vulnerabilities
Known vulnerabilities in Nagios products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
Products
21- Nagios Xi194 vulnerabilities
- XI77 vulnerabilities
- Nagios37 vulnerabilities
- Log Server23 vulnerabilities
- Fusion19 vulnerabilities
- Network Analyzer7 vulnerabilities
- Nagios Core5 vulnerabilities
- Host3 vulnerabilities
- Incident Manager3 vulnerabilities
- Plugins3 vulnerabilities
- Remote Plug In Executor3 vulnerabilities
- Favorites2 vulnerabilities
- Nagios Cross Platform Agent2 vulnerabilities
- Business Process Intelligence1 vulnerabilities
- Nagios Network Analyzer1 vulnerabilities
- Nagios Xi Docker Wizard1 vulnerabilities
- Nagios Xi Switch Wizard1 vulnerabilities
- Nagios Xi Watchguard Wizard1 vulnerabilities
- NCPA1 vulnerabilities
- Ndoutils1 vulnerabilities
- Remote Plugin Executor1 vulnerabilities
CVE-2018-13457debiannagios4+1
EPSS score4.45%
qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.CVE-2018-13441debiannagios4+1EPSS score1.34%
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.CVE-2018-13458debiannagios4+1EPSS score4.45%
qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket.CVE-2018-20171nagiosnagios_xiEPSS score1.59%
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.CVE-2018-20172nagiosnagios_xiEPSS score1.59%
An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.CVE-2018-17147nagiosnagios_xiEPSS score2.70%
Nagios XI before 5.5.4 has XSS in the auto login admin management page.CVE-2018-17146nagiosnagios_xiEPSS score3.54%
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.CVE-2018-17148nagiosnagios_xiEPSS score3.68%
An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.CVE-2018-25122nagiosnagios_xi+1EPSS score1.68%
Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to inject commands or otherwise execute arbitrary code with the privileges of the application service.CVE-2018-25121nagiosnagios_xi+1EPSS score0.42%
Nagios XI versions prior to 5.4.13 are vulnerable to cross-site scripting (XSS) via the Views page of the web interface. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.CVE-2018-25123nagiosnagios_xi+1EPSS score0.35%
Nagios XI versions prior to 5.5.7 contain a privilege escalation vulnerability in the MRTG graphing component. MRTG-related processes/scripts executed with excessive privileges, allowing a local attacker with limited system access to abuse file/command execution paths or writable resources to gain elevated privileges.CVE-2018-25119nagiosfusionEPSS score0.52%
Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.CVE-2018-18245debiannagios4+3EPSS score2.54%
Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE.CVE-2018-10553nagiosnagios_xiEPSS score38.37%
An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings.CVE-2018-10738nagiosnagios_xiEPSS score42.05%
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.CVE-2018-10736nagiosnagios_xiEPSS score42.05%
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.CVE-2018-10735nagiosnagios_xiEPSS score42.05%
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.CVE-2018-10554nagiosnagios_xiEPSS score2.62%
An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime.php, related to the update_pages function; (3) the ajaxhelper.php opts or background parameter; (4) the i[] array parameter to ajax_handler.php; or (5) the deploynotification.php title parameter.CVE-2018-10737nagiosnagios_xiEPSS score42.05%
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.CVE-2018-15713nagiosnagios_xiEPSS score7.17%
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.