CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9166 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9166
Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php. Un escalado de privilegios en Nagios XI, en versiones anteriores a la 5.5.11, permite a los atacantes local elevar privilegios a root mediante un acceso de escritura en config.inc.php en import_xiconfig.php. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with "autodiscovery job" creation privileges) to visit a malicious URL to obtain a remote root shell via a reflected cross site scripting, an authenticated remote code Execution and a local privilege escalation. • http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html https://www.nagios.com/downloads/nagios-xi/change-log https://www.nagios.com/products/security • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-9165 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9165
SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id. Una vulnerabilidad de inyección SQL en Nagios XI, en versiones anteriores a la 5.5.11, permite a los atacantes ejecutar comandos SQL arbitrarios mediante la API cuando se utilizan "fusekeys" y un ID de usuario maliciosos. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with "autodiscovery job" creation privileges) to visit a malicious URL to obtain a remote root shell via a reflected cross site scripting, an authenticated remote code Execution and a local privilege escalation. • http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html https://www.nagios.com/downloads/nagios-xi/change-log https://www.nagios.com/products/security • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 2CVE-2019-9164 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9164
Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. Una inyección de comandos en Nagios XI, en versiones anteriores a la 5.5.11, permite a los usuarios autenticados ejecutar comandos remotos arbitrarios mediante un nuevo trabajo de autodescubrimiento. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with "autodiscovery job" creation privileges) to visit a malicious URL to obtain a remote root shell via a reflected cross site scripting, an authenticated remote code Execution and a local privilege escalation. • http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html http://seclists.org/fulldisclosure/2019/Apr/19 https://www.nagios.com/downloads/nagios-xi/change-log https://www.nagios.com/products/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20171
https://notcve.org/view.php?id=CVE-2018-20171
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability. Se ha descubierto un problema en versiones anteriores a la 5.5.8 de Nagios XI. El parámetro url en rss_dashlet/magpierss/scripts/magpie_simple.php no está filtrado, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS) • https://www.nagios.com/downloads/nagios-xi/change-log https://www.seebug.org/vuldb/ssvid-97713 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20172
https://notcve.org/view.php?id=CVE-2018-20172
An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability. Se ha descubierto un problema en versiones anteriores a la 5.5.8 de Nagios XI. El parámetro rss_url en rss_dashlet/magpierss/scripts/magpie_slashbox.php no está filtrado, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS). • https://www.nagios.com/downloads/nagios-xi/change-log https://www.seebug.org/vuldb/ssvid-97714 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •