Nagios Xi vulnerabilities, page 3
194 vulnerabilities
Known vulnerabilities in Nagios Xi, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-47690nagiosnagios_xi+1
EPSS score0.42%
The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities in Overlay modals. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.CVE-2021-47700nagiosnagios_xi+1EPSS score0.35%
Nagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user. Local or co-hosted processes could read/overwrite export artifacts or manipulate paths, risking disclosure or tampering and potential code execution depending on deployment.CVE-2021-47699nagiosnagios_xi+1EPSS score0.42%
Nagios XI versions prior to 5.8.7 are vulnerable to cross-site scripting (XSS) via the Audit Log page’s Send to NLS form. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.CVE-2021-47693nagiosnagios_xi+1EPSS score1.13%
The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.3 / Nagios XI 5.8.5 contains a SQL injection vulnerability in the search text handling. Unsanitized user-supplied input was incorporated into SQL queries used by configuration object editors, allowing authenticated users to inject SQL fragments. Successful exploitation could lead to unauthorized disclosure or modification of configuration and application data, and in some environments could allow further compromise of the application or backend database.CVE-2021-36365nagiosnagios_xiEPSS score3.80%
Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.CVE-2021-36364nagiosnagios_xiEPSS score4.00%
Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.CVE-2021-36366nagiosnagios_xiEPSS score4.00%
Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.CVE-2021-36363nagiosnagios_xiEPSS score3.80%
Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.CVE-2021-25297nagiosnagios_xiKEVEPSS score56.66%
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.CVE-2021-25296nagiosnagios_xiKEVEPSS score71.94%
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.CVE-2021-25298nagiosnagios_xiKEVEPSS score73.64%
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.CVE-2021-25299nagiosnagios_xiEPSS score97.76%
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.CVE-2021-37352nagiosnagios_xiEPSS score6.05%
An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.CVE-2021-37350nagiosnagios_xiEPSS score79.25%
Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.CVE-2021-37345nagiosnagios_xiEPSS score0.57%
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.CVE-2021-37351nagiosnagios_xiEPSS score2.83%
Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server.CVE-2021-37223nagiosnagios_xiEPSS score4.98%
Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.CVE-2021-37348nagiosnagios_xiEPSS score2.78%
Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php.CVE-2021-37343nagiosnagios_xiEPSS score23.82%
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.CVE-2021-37349nagiosnagios_xiEPSS score0.67%
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database.