Nagios vulnerabilities, page 3

303 vulnerabilities

Known vulnerabilities in Nagios products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.

6.1MediumCVE-2013-10071nagios · nagios_xi +1 moreNagios XI < 2012R1.6 Reflected XSS via Dashlet AJAX Load FunctionalityNagios XI versions prior to 2012R1.6 contain a reflected cross-site scripting (XSS) vulnerability in the dashboard dashlet AJAX load functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.56%7.5HighCVE-2013-6875nagios · nagios_xinagios nagios_xiSQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.EPSS3.24%7.8HighCVE-2021-40343nagios · nagios_xinagios nagios_xiAn issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the root user.EPSS0.65%9CriticalCVE-2021-40345nagios · nagios_xinagios nagios_xiAn issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.EPSS22.69%7.2HighCVE-2021-40344nagios · nagios_xinagios nagios_xiAn issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.EPSS64.80%5.3MediumCVE-2021-26024nagios · favoritesnagios favoritesThe Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account.EPSS19.02%6.1MediumCVE-2021-26023nagios · favoritesnagios favoritesThe Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.EPSS25.18%5.4MediumCVE-2021-47697nagios · nagios_xi +1 moreNagios XI < 5.8.0 XSS via Views URL HandlingNagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via the Views feature URL handling. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.45%6.1MediumCVE-2021-47694nagios · nagios_xi +1 moreNagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test CommandThe Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting (XSS) vulnerability via the Test Command functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.52%5.4MediumCVE-2021-47689nagios · nagios_xi +1 moreNagios XI < 5.8.0 Core Config Manager (CCM) XSS via Templates PagesThe Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.0 / Nagios XI 5.8.0 contais a cross-site scripting (XSS) vulnerability in the Templates pages, specifically in the UI logic that renders and handles the Active/Actions buttons. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.44%5.4MediumCVE-2021-47698nagios · nagios_xi +1 moreNagios XI < 5.8.7 XSS in Core UI Views URL handlingNagios XI versions prior to 5.8.7 using embedded Nagios Core are vulnerable to cross-site scripting (XSS) via the Core UI’s Views URL handling (escape_string()). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.44%5.4MediumCVE-2021-47696nagios · nagios_xi +1 moreNagios XI < 5.8.0 XSS via BPI Config ID HandlingNagios XI versions prior to 5.8.0 are vulnerable to cross-site scripting (XSS) via BPI config ID handling. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.45%5.4MediumCVE-2021-47691nagios · nagios_xi +1 moreNagios XI < 5.8.2 Core Config Manager (CCM) XSS via Services PageThe Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities via the Services page affecting the config_name and service_description fields. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.45%5.4MediumCVE-2021-47695nagios · nagios_xi +1 moreNagios XI < 5.8.0 XSS via My Tools PageNagios XI versions prior to 5.8.0 are vulnerable to stored cross-site scripting (XSS) via the My Tools page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.45%5.4MediumCVE-2021-47690nagios · nagios_xi +1 moreNagios XI < 5.8.2 Core Config Manager (CCM) XSS via Overlay ModalsThe Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.1 / Nagios XI 5.8.2 contains multiple cross-site scripting (XSS) vulnerabilities in Overlay modals. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.42%8.5HighCVE-2021-47700nagios · nagios_xi +1 moreNagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary DirectoryNagios XI versions prior to 5.8.7 used a temporary directory for Highcharts exports with overly permissive ownership/permissions under the Apache user. Local or co-hosted processes could read/overwrite export artifacts or manipulate paths, risking disclosure or tampering and potential code execution depending on deployment.EPSS0.35%5.4MediumCVE-2021-47699nagios · nagios_xi +1 moreNagios XI < 5.8.7 XSS in Audit Log via Send to NLS FormNagios XI versions prior to 5.8.7 are vulnerable to cross-site scripting (XSS) via the Audit Log page’s Send to NLS form. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.EPSS0.42%8.8HighCVE-2021-47693nagios · nagios_xi +1 moreNagios XI < 5.8.5 Core Config Manager (CCM) SQL Injection via Improper Escaping in Search TextThe Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.3 / Nagios XI 5.8.5 contains a SQL injection vulnerability in the search text handling. Unsanitized user-supplied input was incorporated into SQL queries used by configuration object editors, allowing authenticated users to inject SQL fragments. Successful exploitation could lead to unauthorized disclosure or modification of configuration and application data, and in some environments could allow further compromise of the application or backend database.EPSS1.13%9.8CriticalCVE-2021-36365nagios · nagios_xinagios nagios_xiNagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.EPSS3.80%9.8CriticalCVE-2021-36364nagios · nagios_xinagios nagios_xiNagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.EPSS4.00%