CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18247
https://notcve.org/view.php?id=CVE-2018-18247
Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter. Icinga Web 2 en versiones anteriores a la 2.6.2 tiene Cross-Site Scripting (XSS) mediante el parámetro icon en /icingaweb2/navigation/add. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180029.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18248
https://notcve.org/view.php?id=CVE-2018-18248
Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string. Icinga Web 2 tiene Cross-Site Scripting (XSS) mediante el parámetro dir en /icingaweb2/monitoring/list/services o las cadenas de consulta /icingaweb2/user/list, /icingaweb2/monitoring/timeline o /icingaweb2/setup. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180028.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18250
https://notcve.org/view.php?id=CVE-2018-18250
Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navigation item. Icinga Web 2 en versiones anteriores a la 2.6.2 permite parámetros que rompen los dashlets de navegación, tal y como queda demostrado con un único carácter "$" como nombre de un ítem Navigation. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00031.html https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180030.txt • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6532
https://notcve.org/view.php?id=CVE-2018-6532
An issue was discovered in Icinga 2.x through 2.8.1. By sending specially crafted (authenticated and unauthenticated) requests, an attacker can exhaust a lot of memory on the server side, triggering the OOM killer. Se ha descubierto un problema en Icinga, en versiones 2.x hasta la 2.8.1. Mediante el envío de peticiones (autenticadas y no autenticadas) especialmente manipuladas, un atacante puede agotar mucha memoria del lado del servidor, desencadenando el killer OOM. • https://github.com/Icinga/icinga2/pull/6103 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6535
https://notcve.org/view.php?id=CVE-2018-6535
An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclose the password to an attacker. Se ha descubierto un problema en Icinga, en versiones 2.x hasta la 2.8.1. La falta de una función de comparación de contraseña en tiempo constante (constant-time) puede revelar la contraseña a un atacante. • https://github.com/Icinga/icinga2/issues/4920 https://github.com/Icinga/icinga2/pull/5715 •