CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17148
https://notcve.org/view.php?id=CVE-2018-17148
An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials. Una vulnerabilidad de Control de acceso insuficiente (que lleva a la divulgación de credenciales) en coreconfigsnapshot.php (también conocida como página de instantáneas de configuración) en Nagios XI antes de 5.5.4 permite a los atacantes remotos acceder a los archivos de configuración que contienen credenciales confidenciales. • https://assets.nagios.com/downloads/nagiosxi/CHANGES-5.TXT • CWE-284: Improper Access Control •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2019-12279 – Nagios XI 5.6.1 - SQL injection
https://notcve.org/view.php?id=CVE-2019-12279
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck ** EN DIPUTA ** Nagios XI 5.6.1 permite que se produzca inyección SQL mediante el parámetro username para login.php? • https://www.exploit-db.com/exploits/46910 http://packetstormsecurity.com/files/153040/Nagios-XI-5.6.1-SQL-Injection.html http://www.securityfocus.com/bid/108446 https://github.com/JameelNabbo/exploits/blob/master/nagiosxi%20username%20sql%20injection.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 7%CPEs: 1EXPL: 1CVE-2019-9167 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9167
Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter. Una vulnerabilidad de Cross-Site Scripting (XSS) en Nagios XI, en versiones anteriores a la 5.5.11, permite a los atacantes inyectar scripts web o HTML arbitrarios mediante el parámetro xiwindow. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with "autodiscovery job" creation privileges) to visit a malicious URL to obtain a remote root shell via a reflected cross site scripting, an authenticated remote code Execution and a local privilege escalation. • http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html https://www.nagios.com/downloads/nagios-xi/change-log https://www.nagios.com/products/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9166 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9166
Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php. Un escalado de privilegios en Nagios XI, en versiones anteriores a la 5.5.11, permite a los atacantes local elevar privilegios a root mediante un acceso de escritura en config.inc.php en import_xiconfig.php. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with "autodiscovery job" creation privileges) to visit a malicious URL to obtain a remote root shell via a reflected cross site scripting, an authenticated remote code Execution and a local privilege escalation. • http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html https://www.nagios.com/downloads/nagios-xi/change-log https://www.nagios.com/products/security • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-9165 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9165
SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id. Una vulnerabilidad de inyección SQL en Nagios XI, en versiones anteriores a la 5.5.11, permite a los atacantes ejecutar comandos SQL arbitrarios mediante la API cuando se utilizan "fusekeys" y un ID de usuario maliciosos. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with "autodiscovery job" creation privileges) to visit a malicious URL to obtain a remote root shell via a reflected cross site scripting, an authenticated remote code Execution and a local privilege escalation. • http://packetstormsecurity.com/files/152496/Nagios-XI-5.5.10-XSS-Remote-Code-Execution.html https://www.nagios.com/downloads/nagios-xi/change-log https://www.nagios.com/products/security • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •