CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2020-14004
https://notcve.org/view.php?id=CVE-2020-14004
An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user. Se detectó un problema en Icinga2 versiones anteriores a v2.12.0-rc1. • http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.html http://www.openwall.com/lists/oss-security/2020/06/12/1 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-14004 https://github.com/Icinga/icinga2/compare/v2.12.0-rc1...master https://github.com/Icinga/icinga2/pull/8045/commits/2f0f2e8c355b75fa4407d23f85feea037d2bc4b6 https://github.com/Icinga/icinga2/releases • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18246
https://notcve.org/view.php?id=CVE-2018-18246
Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2/config/moduleenable?name=setup to enable the setup module. Icinga Web 2 en versiones anteriores a la 2.6.2 tiene CSRF mediante /icingaweb2/config/moduledisable?name=monitoring para deshabilitar el módulo de monitorización o mediante /icingaweb2/config/moduleenable? • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180027.txt • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18247
https://notcve.org/view.php?id=CVE-2018-18247
Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter. Icinga Web 2 en versiones anteriores a la 2.6.2 tiene Cross-Site Scripting (XSS) mediante el parámetro icon en /icingaweb2/navigation/add. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180029.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18248
https://notcve.org/view.php?id=CVE-2018-18248
Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string. Icinga Web 2 tiene Cross-Site Scripting (XSS) mediante el parámetro dir en /icingaweb2/monitoring/list/services o las cadenas de consulta /icingaweb2/user/list, /icingaweb2/monitoring/timeline o /icingaweb2/setup. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180028.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18250
https://notcve.org/view.php?id=CVE-2018-18250
Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item. Icinga Web 2 en versiones anteriores a la 2.6.2 permite parámetros que rompen los dashlets de navegación, tal y como queda demostrado con un único carácter "$" como nombre de un ítem Navigation. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180030.txt • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •