Nagios vulnerabilities, page 4
303 vulnerabilities
Known vulnerabilities in Nagios products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
CriticalCVE-2021-36366nagios · nagios_xinagios nagios_xiNagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.EPSS4.00%CriticalCVE-2021-36363nagios · nagios_xinagios nagios_xiNagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.EPSS3.80%MediumCVE-2021-4285nagios · nagios_cross_platform_agent +1 moreNagios NCPA tail.html cross site scriptingA vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to address this issue. The name of the patch is 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5. It is recommended to upgrade the affected component. VDB-216874 is the identifier assigned to this vulnerability.EPSS1.77%CriticalCVE-2021-25297nagios · nagios_xinagios nagios_xiNagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.KEVEPSS56.66%CriticalCVE-2021-25296nagios · nagios_xinagios nagios_xiNagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.KEVEPSS71.94%CriticalCVE-2021-25298nagios · nagios_xinagios nagios_xiNagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.KEVEPSS73.64%MediumCVE-2021-25299nagios · nagios_xinagios nagios_xiNagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.EPSS97.76%CriticalCVE-2021-37353nagios · nagios_xi_docker_wizardnagios nagios_xi_docker_wizardNagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php.EPSS2.94%MediumCVE-2021-37352nagios · nagios_xinagios nagios_xiAn open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.EPSS6.05%CriticalCVE-2021-37350nagios · nagios_xinagios nagios_xiNagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.EPSS79.25%HighCVE-2021-37345nagios · nagios_xinagios nagios_xiNagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.EPSS0.57%CriticalCVE-2021-37346nagios · nagios_xi_watchguard_wizardnagios nagios_xi_watchguard_wizardNagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).EPSS73.59%MediumCVE-2021-37351nagios · nagios_xinagios nagios_xiNagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server.EPSS2.83%MediumCVE-2021-37223nagios · nagios_xinagios nagios_xiNagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.EPSS4.98%HighCVE-2021-37348nagios · nagios_xinagios nagios_xiNagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php.EPSS2.78%HighCVE-2021-37343nagios · nagios_xinagios nagios_xiA path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.EPSS23.82%HighCVE-2021-37349nagios · nagios_xinagios nagios_xiNagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database.EPSS0.67%CriticalCVE-2021-37344nagios · nagios_xi_switch_wizardnagios nagios_xi_switch_wizardNagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).EPSS96.77%HighCVE-2021-37347nagios · nagios_xinagios nagios_xiNagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument.EPSS0.78%MediumCVE-2021-43584nagios · nagios_cross_platform_agentnagios nagios_cross_platform_agentDOM-based Cross Site Scripting (XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent (NCPA) before 2.4.0 allows attackers to run arbitrary code via the name element when filtering for a log.EPSS1.20%