Page 2 of 24 results (0.001 seconds)

CVSS: 6.1EPSS: 6%CPEs: 1EXPL: 2

CVE-2020-28903 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution

https://notcve.org/view.php?id=CVE-2020-28903

24 May 2021 — Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS. Una Comprobación Inapropiada de la Entrada en Nagios Fusion versiones 4.1.8 y anteriores, permite a un atacante remoto con control sobre un servidor fusionado inyectar HTML arbitrario, también se conoce como XSS Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include remote code execution, cross sit... • https://packetstorm.news/files/id/162783 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 2

CVE-2020-28902 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution

https://notcve.org/view.php?id=CVE-2020-28902

24 May 2021 — Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php. Una Inyección de Comandos en Nagios Fusion versiones 4.1.8 y anteriores, permite la escalada de privilegios de apache a root en el archivo cmd_subsys.php Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include remote code execution, cross site scripting, privilege escalation, and more. • https://packetstorm.news/files/id/162783 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 2

CVE-2020-28901 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution

https://notcve.org/view.php?id=CVE-2020-28901

24 May 2021 — Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php. Una Inyección de Comandos en Nagios Fusion versiones 4.1.8 y anteriores, permite la Escalada de Privilegios o una Ejecución de Código como root por medio de vectores relacionados con la instalación de componentes corruptos en el archivo cmd_subsys.php Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and... • https://packetstorm.news/files/id/162783 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •

CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 2

CVE-2020-28900 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution

https://notcve.org/view.php?id=CVE-2020-28900

24 May 2021 — Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh. Una Comprobación Insuficiente de la Autenticidad de los Datos en Nagios Fusion versiones 4.1.8 y anteriores y Nagios XI versiones 5.7.5 y anteriores, permite la ampliación de privilegios o una ejecución de código como root por medio de vectores relacionados co... • https://packetstorm.news/files/id/162783 • CWE-345: Insufficient Verification of Data Authenticity •

CVSS: 6.1EPSS: 3%CPEs: 1EXPL: 0

CVE-2018-12501

https://notcve.org/view.php?id=CVE-2018-12501

16 Jun 2018 — Nagios Fusion before 4.1.4 has XSS, aka TPS#13332-13335. Nagios Fusion en versiones anteriores a la 4.1.4 tiene Cross-Site Scripting (XSS). Esto también se conoce como TPS#13332-13335. • https://www.nagios.com/downloads/nagios-fusion/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 1

CVE-2012-1666 – ThinPrint - 'tpfc.dll' Insecure Library Loading Arbitrary Code Execution

https://notcve.org/view.php?id=CVE-2012-1666

08 Sep 2012 — Untrusted search path vulnerability in VMware Tools in VMware Workstation before 8.0.4, VMware Player before 4.0.4, VMware Fusion before 4.1.2, VMware View before 5.1, and VMware ESX 4.1 before U3 and 5.0 before P03 allows local users to gain privileges via a Trojan horse tpfc.dll file in the current working directory. Vulnerabilidad de path de búsqueda no confiable en VMware Tools en VMware Workstation anteriores a v8.0.4, VMware Player anteriores a v4.0.4, VMware Fusion anteriores a v4.1.2, VMware View an... • https://www.exploit-db.com/exploits/37780 •

CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0

CVE-2012-2083

https://notcve.org/view.php?id=CVE-2012-2083

31 Aug 2012 — Cross-site scripting (XSS) vulnerability in the fusion_core_preprocess_page function in fusion_core/template.php in the Fusion module before 6.x-1.13 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la función fusion_core_preprocess_page de fusion_core/template.php en el módulo Fusion anteriores a v6.x-1.13 para Drupal permite a atacantes remotos inyectar código web o HTML de su elección a travé... • http://drupal.org/node/1506600 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 1

CVE-2009-3281 – VMware Fusion 2.0.5 - vmx86 kext Kernel Privilege Escalation

https://notcve.org/view.php?id=CVE-2009-3281

16 Oct 2009 — The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to gain privileges on the host OS via unspecified vectors. La extensión del núcleo vmx86 en VMware Fusion v2.0.6 anterior a build 196839 no utiliza los permisos de archivo correctos, lo cual permite a los usuarios del sistema operativo anfitrion obtener privilegios en el sistema operativo anfitrión a través de vectores no especificados. • https://www.exploit-db.com/exploits/10076 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0

CVE-2009-3282

https://notcve.org/view.php?id=CVE-2009-3282

16 Oct 2009 — Integer overflow in the vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 allows host OS users to cause a denial of service to the host OS via unspecified vectors. Desbordamiento de enteros en la extensión del núcleo vmx86 en VMware Fusion v2.0.6 anterior a build 196839 permite a los usuarios del sistema operativo anfitrión causar una denegación de servicio al sistema operativo anfitrión a través de vectores no especificados. • http://lists.vmware.com/pipermail/security-announce/2009/000066.html • CWE-189: Numeric Errors •

CVSS: 6.5EPSS: 0%CPEs: 101EXPL: 0

CVE-2009-1805

https://notcve.org/view.php?id=CVE-2009-1805

01 Jun 2009 — Unspecified vulnerability in the VMware Descheduled Time Accounting driver in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745, VMware Fusion 2.x before 2.0.2 build 147997, VMware ESXi 3.5, and VMware ESX 3.0.2, 3.0.3, and 3.5, when the Descheduled Time Accounting Service is not running, allows guest OS users on Windows to cause a denial of service via unknown vectors. Vulnerabil... • http://secunia.com/advisories/35269 •