Nagios vulnerabilities, page 5
303 vulnerabilities
Known vulnerabilities in Nagios products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 21 products.
MediumCVE-2021-38156nagios · nagios_xinagios nagios_xiIn Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.EPSS92.91%CriticalCVE-2021-28925nagios · network_analyzernagios network_analyzerSQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/.EPSS4.82%MediumCVE-2021-28924nagios · network_analyzernagios network_analyzerSelf Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.EPSS10.54%CriticalCVE-2021-3273nagios · nagios_xinagios nagios_xiNagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.EPSS7.21%CriticalCVE-2021-3193nagios · nagios_xinagios nagios_xiImproper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.EPSS9.89%HighCVE-2021-3277nagios · nagios_xinagios nagios_xiNagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.EPSS54.58%MediumCVE-2021-35479nagios · log_servernagios log_serverNagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page.EPSS13.15%MediumCVE-2021-35478nagios · log_servernagios log_serverNagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.EPSS76.62%MediumCVE-2021-33179nagios · nagios_xinagios nagios_xiThe general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload.EPSS11.68%HighCVE-2021-33177nagios · nagios_xinagios nagios_xiThe Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries.EPSS10.13%MediumCVE-2015-3618nagios · business_process_intelligencenagios business_process_intelligenceCross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving index.php.EPSS1.36%MediumCVE-2007-5198debian · nagios-plugins +1 moredebian nagios-pluginsBuffer overflow in the redir function in check_http.c in Nagios Plugins before 1.4.10, when running with the -f (follow) option, allows remote web servers to execute arbitrary code via Location header responses (redirects) with a large number of leading "L" characters.EPSS8.02%MediumCVE-2007-5623nagios · plugins +2 morenagios pluginsBuffer overflow in the check_snmp function in Nagios Plugins (nagios-plugins) 1.4.10 allows remote attackers to cause a denial of service (crash) via crafted snmpget replies.EPSS2.77%MediumCVE-2007-5803nagiosnagios nagiosMultiple cross-site scripting (XSS) vulnerabilities in CGI programs in Nagios before 2.12 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different issue than CVE-2007-5624 and CVE-2008-1360.EPSS1.77%MediumCVE-2007-5624nagiosnagios nagiosCross-site scripting (XSS) vulnerability in Nagios 2.x before 2.10 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts.EPSS2.00%CriticalCVE-2016-0726nagiosnagios nagiosThe Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.EPSS2.26%CriticalCVE-2016-9565ubuntu · nagios3 +1 moreubuntu nagios3MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.EPSS22.68%HighCVE-2016-9566ubuntu · nagios3 +1 moreubuntu nagios3base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.EPSS4.88%HighCVE-2016-10089nagiosnagios nagiosNagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.EPSS0.52%MediumCVE-2016-15049nagios · log_serverNagios Log Server < 1.4.2 Dashboards Logs Table XSSNagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin.EPSS0.51%