CVSS: 7.5EPSS: 97%CPEs: 32EXPL: 4CVE-2009-2288 – Nagios 3.0.6 - 'statuswml.cgi' Arbitrary Shell Command Injection
https://notcve.org/view.php?id=CVE-2009-2288
statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters. statuswml.cgi en Nagios v3.1.1, permite a atacantes remotos ejecutar comandos de su elección a través de metacaracteres de consola en los parámetros (1) ping o (2) Traceroute. • https://www.exploit-db.com/exploits/33051 https://www.exploit-db.com/exploits/16908 https://www.exploit-db.com/exploits/9861 http://marc.info/?l=bugtraq&m=126996888626964&w=2 http://secunia.com/advisories/35543 http://secunia.com/advisories/35688 http://secunia.com/advisories/35692 http://secunia.com/advisories/39227 http://security.gentoo.org/glsa/glsa-200907-15.xml http://tracker.nagios.org/view.php?id=15 http://www.debian.org/security/2009/dsa-1825 http: • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.0EPSS: 0%CPEs: 55EXPL: 0CVE-2008-6373
https://notcve.org/view.php?id=CVE-2008-6373
Unspecified vulnerability in Nagios before 3.0.6 has unspecified impact and remote attack vectors related to CGI programs, "adaptive external commands," and "writing newlines and submitting service comments." Vulnerabilidad no especificada en Nagios versiones anteriores a v3.0.6 tiene un impacto no especificado y vectores de ataque remoto relacionados con los programas CGI, "comandos de adaptación externa", e "introducción de nuevas líneas y envío de comentarios de servicio". • http://marc.info/?l=bugtraq&m=124156641928637&w=2 http://secunia.com/advisories/32909 http://secunia.com/advisories/35002 http://security.gentoo.org/glsa/glsa-200907-15.xml http://www.nagios.org/development/history/nagios-3x.php http://www.nagios.org/news/#88 http://www.securityfocus.com/bid/32611 http://www.securitytracker.com/id?1022165 http://www.vupen.com/english/advisories/2009/1256 https://exchange.xforce.ibmcloud.com/vulnerabilities/47081 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 1%CPEs: 5EXPL: 0CVE-2008-4796 – Feed2JS File Disclosure
https://notcve.org/view.php?id=CVE-2008-4796
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs. La función _httpsrequest function (Snoopy/Snoopy.class.php) en Snoopy 1.2.3 y versiones anteriores, cuando es usada en (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost y posiblemente otros productos, permite a atacantes remotos ejecutar comandos arbitrarios a través de metacarácteres shell en URLs https. Feed2JS uses MagpieRSS for parsing the feeds, and MagpieRSS uses Snoopy library for fetching the documents. The version of Snoopy in use suffers from a local file disclosure vulnerability. • http://jvn.jp/en/jp/JVN20502807/index.html http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-000074.html http://secunia.com/advisories/32361 http://sourceforge.net/forum/forum.php?forum_id=879959 http://www.debian.org/security/2008/dsa-1691 http://www.debian.org/security/2009/dsa-1871 http://www.openwall.com/lists/oss-security/2008/11/01/1 http://www.securityfocus.com/archive/1/496068/100/0/threaded http://www.securityfocus.com/bid/31887 http://www.vupen • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •