CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6584
https://notcve.org/view.php?id=CVE-2020-6584
Nagios Log Server 2.1.3 has Incorrect Access Control. Nagios Log Server versión 2.1.3, presenta un Control de Acceso Incorrecto. • https://assets.nagios.com/downloads/nagios-log-server/CHANGES.TXT https://medium.com/%40fixitt6/multiple-vulnerabilities-in-nagios-log-server-2-1-3-af7c160edc60 https://www.nagios.com/products/nagios-log-server • CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6585
https://notcve.org/view.php?id=CVE-2020-6585
Nagios Log Server 2.1.3 has CSRF. Nagios Log Server versión 2.1.3, presenta una vulnerabilidad de tipo CSRF. • https://assets.nagios.com/downloads/nagios-log-server/CHANGES.TXT https://medium.com/%40fixitt6/multiple-vulnerabilities-in-nagios-log-server-2-1-3-af7c160edc60 https://www.nagios.com/products/nagios-log-server • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6586
https://notcve.org/view.php?id=CVE-2020-6586
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered. Nagios Log Server versión 2.1.3, permite un ataque de tipo XSS al visitar /profile e ingresar un campo name diseñado que se maneja inapropiadamente en la página /admin/users. Cualquier usuario malicioso con acceso limitado puede almacenar una carga útil de tipo XSS en su . • https://assets.nagios.com/downloads/nagios-log-server/CHANGES.TXT https://medium.com/%40fixitt6/multiple-vulnerabilities-in-nagios-log-server-2-1-3-af7c160edc60 https://www.nagios.com/products/nagios-log-server • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.0EPSS: 0%CPEs: 6EXPL: 1CVE-2019-3698 – nagios cron job allows privilege escalation from user nagios to root
https://notcve.org/view.php?id=CVE-2019-3698
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions. Una vulnerabilidad de tipo UNIX Symbolic Link (Symlink) Following en el cronjob enviado con nagios de SUSE Linux Enterprise Server versión 12, SUSE Linux Enterprise Server versión 11; openSUSE Factory, permite a atacantes locales causar una DoS o escalar potencialmente privilegios al ganar una carrera. Este problema afecta: SUSE Linux Enterprise Server versión 12 nagios versión 3.5.1-5.27 y versiones anteriores. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html https://bugzilla.suse.com/show_bug.cgi?id=1156309 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 2CVE-2018-13441 – Nagios Core 4.4.1 - Denial of Service
https://notcve.org/view.php?id=CVE-2018-13441
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. qh_help en Nagios Core en versiones 4.4.1 y anteriores es propenso a una vulnerabilidad de desreferencia de puntero NULL que permite que un atacante provoque una condición de denegación de servicio (DoS) local mediante el envío de una carga útil manipulada al socket UNIX en escucha. Nagios Core versions 4.4.1 and below suffer from a denial of service vulnerability. • https://www.exploit-db.com/exploits/45082 http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html https://gist.github.com/fakhrizulkifli/8df4a174158df69ebd765f824bd736b8 https://knowledge.opsview.com/v5.3/docs/whats-new https://knowledge.opsview.com/v5.4/docs/whats-new • CWE-476: NULL Pointer Dereference •