CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 2CVE-2020-28901 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28901
24 May 2021 — Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php. Una Inyección de Comandos en Nagios Fusion versiones 4.1.8 y anteriores, permite la Escalada de Privilegios o una Ejecución de Código como root por medio de vectores relacionados con la instalación de componentes corruptos en el archivo cmd_subsys.php Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and... • https://packetstorm.news/files/id/162783 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 2CVE-2020-28900 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28900
24 May 2021 — Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh. Una Comprobación Insuficiente de la Autenticidad de los Datos en Nagios Fusion versiones 4.1.8 y anteriores y Nagios XI versiones 5.7.5 y anteriores, permite la ampliación de privilegios o una ejecución de código como root por medio de vectores relacionados co... • https://packetstorm.news/files/id/162783 • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 6.1EPSS: 3%CPEs: 1EXPL: 0CVE-2018-12501
https://notcve.org/view.php?id=CVE-2018-12501
16 Jun 2018 — Nagios Fusion before 4.1.4 has XSS, aka TPS#13332-13335. Nagios Fusion en versiones anteriores a la 4.1.4 tiene Cross-Site Scripting (XSS). Esto también se conoce como TPS#13332-13335. • https://www.nagios.com/downloads/nagios-fusion/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 20EXPL: 1CVE-2012-1666 – ThinPrint - 'tpfc.dll' Insecure Library Loading Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2012-1666
08 Sep 2012 — Untrusted search path vulnerability in VMware Tools in VMware Workstation before 8.0.4, VMware Player before 4.0.4, VMware Fusion before 4.1.2, VMware View before 5.1, and VMware ESX 4.1 before U3 and 5.0 before P03 allows local users to gain privileges via a Trojan horse tpfc.dll file in the current working directory. Vulnerabilidad de path de búsqueda no confiable en VMware Tools en VMware Workstation anteriores a v8.0.4, VMware Player anteriores a v4.0.4, VMware Fusion anteriores a v4.1.2, VMware View an... • https://www.exploit-db.com/exploits/37780 •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 0CVE-2012-2083
https://notcve.org/view.php?id=CVE-2012-2083
31 Aug 2012 — Cross-site scripting (XSS) vulnerability in the fusion_core_preprocess_page function in fusion_core/template.php in the Fusion module before 6.x-1.13 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la función fusion_core_preprocess_page de fusion_core/template.php en el módulo Fusion anteriores a v6.x-1.13 para Drupal permite a atacantes remotos inyectar código web o HTML de su elección a travé... • http://drupal.org/node/1506600 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 2%CPEs: 48EXPL: 0CVE-2012-3288
https://notcve.org/view.php?id=CVE-2012-3288
14 Jun 2012 — VMware Workstation 7.x before 7.1.6 and 8.x before 8.0.4, VMware Player 3.x before 3.1.6 and 4.x before 4.0.4, VMware Fusion 4.x before 4.1.3, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 allow user-assisted remote attackers to execute arbitrary code on the host OS or cause a denial of service (memory corruption) on the host OS via a crafted Checkpoint file. VMware Workstation v7.x antes de v7.1.6 y v8.x antes de v8.0.4, VMware Player v3.x antes de v3.1.6 y v4.x antes de v4.0.4, VMware Fusion... • http://www.vmware.com/security/advisories/VMSA-2012-0011.html • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 2%CPEs: 29EXPL: 0CVE-2012-2449
https://notcve.org/view.php?id=CVE-2012-2449
04 May 2012 — VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x through 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly configure the virtual floppy device, which allows guest OS users to cause a denial of service (out-of-bounds write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS. VMware Workstation v8.x antes de v8.0.3, VMware Player v4.x antes de v4.0.3, VM... • http://osvdb.org/81694 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 1%CPEs: 28EXPL: 0CVE-2012-2450
https://notcve.org/view.php?id=CVE-2012-2450
04 May 2012 — VMware Workstation 8.x before 8.0.3, VMware Player 4.x before 4.0.3, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 do not properly register SCSI devices, which allows guest OS users to cause a denial of service (invalid write operation and VMX process crash) or possibly execute arbitrary code on the host OS by leveraging administrative privileges on the guest OS. VMware Workstation v8.x antes de v8.0.3, VMware Player v4.x antes de v4.0.3 VMware Fusion v4.x, ante... • http://osvdb.org/81695 •
CVSS: 8.8EPSS: 0%CPEs: 27EXPL: 0CVE-2012-1518
https://notcve.org/view.php?id=CVE-2012-1518
17 Apr 2012 — VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors. VMware Workstation versiones 8.x anteriores a 8.0.2, VMware Player versiones 4.x anteriores a 4.0.2, VMware Fusion versiones 4.x anteriores a 4.1.2, VMware ESXi versiones 3.5 hasta 5.0, y VMware ESX versiones 3.5 hasta 4... • http://osvdb.org/81163 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 101EXPL: 0CVE-2009-1805
https://notcve.org/view.php?id=CVE-2009-1805
01 Jun 2009 — Unspecified vulnerability in the VMware Descheduled Time Accounting driver in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, VMware Server 1.x before 1.0.9 build 156507 and 2.x before 2.0.1 build 156745, VMware Fusion 2.x before 2.0.2 build 147997, VMware ESXi 3.5, and VMware ESX 3.0.2, 3.0.3, and 3.5, when the Descheduled Time Accounting Service is not running, allows guest OS users on Windows to cause a denial of service via unknown vectors. Vulnerabil... • http://secunia.com/advisories/35269 •