Page 6 of 62 results (0.006 seconds)

CVSS: 8.8EPSS: 37%CPEs: 1EXPL: 3

CVE-2019-9164 – Nagios XI 5.5.10 XSS / Remote Code Execution

https://notcve.org/view.php?id=CVE-2019-9164

28 Mar 2019 — Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. Una inyección de comandos en Nagios XI, en versiones anteriores a la 5.5.11, permite a los usuarios autenticados ejecutar comandos remotos arbitrarios mediante un nuevo trabajo de autodescubrimiento. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with "autodiscovery job" creation... • https://packetstorm.news/files/id/152496 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 3%CPEs: 1EXPL: 1

CVE-2018-20171

https://notcve.org/view.php?id=CVE-2018-20171

17 Dec 2018 — An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability. Se ha descubierto un problema en versiones anteriores a la 5.5.8 de Nagios XI. El parámetro url en rss_dashlet/magpierss/scripts/magpie_simple.php no está filtrado, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS) • https://www.nagios.com/downloads/nagios-xi/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 3%CPEs: 1EXPL: 1

CVE-2018-20172

https://notcve.org/view.php?id=CVE-2018-20172

17 Dec 2018 — An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability. Se ha descubierto un problema en versiones anteriores a la 5.5.8 de Nagios XI. El parámetro rss_url en rss_dashlet/magpierss/scripts/magpie_slashbox.php no está filtrado, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS). • https://www.nagios.com/downloads/nagios-xi/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.2EPSS: 78%CPEs: 2EXPL: 1

CVE-2018-10735

https://notcve.org/view.php?id=CVE-2018-10735

16 May 2018 — A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter. Se ha descubierto un problema de inyección SQL en Nagios XI en versiones anteriores a la 5.4.13 mediante el parámetro cname en admin/commandline.php. • https://www.seebug.org/vuldb/ssvid-97265 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.2EPSS: 70%CPEs: 2EXPL: 1

CVE-2018-10736

https://notcve.org/view.php?id=CVE-2018-10736

16 May 2018 — A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter. Se ha descubierto un problema de inyección SQL en Nagios XI en versiones anteriores a la 5.4.13 mediante el parámetro key1 en admin/info.php. • https://www.seebug.org/vuldb/ssvid-97266 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.2EPSS: 70%CPEs: 2EXPL: 1

CVE-2018-10737

https://notcve.org/view.php?id=CVE-2018-10737

16 May 2018 — A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter. Se ha descubierto un problema de inyección SQL en Nagios XI en versiones anteriores a la 5.4.13 mediante el parámetro txtSearch en admin/logbook.php. • https://www.seebug.org/vuldb/ssvid-97267 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.2EPSS: 70%CPEs: 2EXPL: 1

CVE-2018-10738

https://notcve.org/view.php?id=CVE-2018-10738

16 May 2018 — A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter. Se ha descubierto un problema de inyección SQL en Nagios XI en versiones anteriores a la 5.4.13 mediante el parámetro chbKey1 en admin/menuaccess.php. • https://www.seebug.org/vuldb/ssvid-97268 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 9.8EPSS: 79%CPEs: 1EXPL: 5

CVE-2018-8733 – Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution

https://notcve.org/view.php?id=CVE-2018-8733

18 Apr 2018 — Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability. Vulnerabilidad de omisión de autenticación en el gestor core config en Nagios XI, en versiones 5.2.x hasta la 5.4.x anteriores a la 5.4.13, permite que un atacante no autenticado realice cambios en la configuración y aproveche una vulnerabilidad de inyección SQL autenticada. • https://packetstorm.news/files/id/148374 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 9.8EPSS: 79%CPEs: 1EXPL: 5

CVE-2018-8734 – Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution

https://notcve.org/view.php?id=CVE-2018-8734

18 Apr 2018 — SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter. Vulnerabilidad de inyección SQL en el gestor core config en Nagios XI, en versiones 5.2.x hasta la 5.4.x anteriores a la 5.4.13, permite que un atacante ejecute comandos SQL arbitrarios mediante el parámetro selInfoKey1. • https://packetstorm.news/files/id/148374 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 9.0EPSS: 73%CPEs: 1EXPL: 5

CVE-2018-8735 – Nagios XI 5.2.6-5.4.12 - Chained Remote Code Execution

https://notcve.org/view.php?id=CVE-2018-8735

18 Apr 2018 — Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection. Vulnerabilidad de ejecución remota de comandos (RCE) en Nagios XI, en versiones 5.2.x hasta la 5.4.x anteriores a la 5.4.13, permite que un atacante ejecute comandos arbitrarios en el sistema objetivo. Esto también se conoce como inyección de comandos del sistema operativo. • https://packetstorm.news/files/id/148374 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •