CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2020-22427
https://notcve.org/view.php?id=CVE-2020-22427
NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted, and the only option is to pay for a subscription service where technical details may be disclosed at an unspecified later time ** EN DISPUTA ** NagiosXI versión 5.6.11, está afectado por una vulnerabilidad de ejecución de código remota (RCE). Un usuario autenticado puede inyectar comandos adicionales en una petición. NOTA: el vendedor discute si el CVE y sus referencias son procesables porque se omiten todos los detalles técnicos, y la única opción es pagar por un servicio de suscripción en el que los detalles técnicos pueden ser revelados en un momento posterior no especificado • https://code610.blogspot.com/2020/03/postauth-rce-bugs-in-nagiosxi-5611.html •
CVSS: 6.1EPSS: 96%CPEs: 1EXPL: 2CVE-2021-25299 – Nagios XI 5.7.5 Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-25299
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server. Nagios XI versión xi-5.7.5, esta afectada por una vulnerabilidad de tipo cross-site scripting (XSS). La vulnerabilidad se presenta en el archivo /usr/local/nagiosxi/html/admin/sshterm.php debido a un saneamiento inapropiado de la entrada controlada por el usuario. • http://nagios.com http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html https://assets.nagios.com/downloads/nagiosxi/versions.php https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 96%CPEs: 1EXPL: 4CVE-2021-25296 – Nagios XI OS Command Injection
https://notcve.org/view.php?id=CVE-2021-25296
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. Nagios XI versión xi-5.7.5, esta afectada por una inyección de comandos del Sistema Operativo. La vulnerabilidad se presenta en el archivo /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php debido a un saneamiento inapropiado de la entrada controlada por el usuario autenticado mediante una única petición HTTP, que puede conllevar a una inyección de comandos del el servidor de Nagios XI Nagios XI version 5.7.5 suffers from a cross site scripting and multiple remote code execution vulnerabilities. Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. • http://nagios.com http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html https://assets.nagios.com/downloads/nagiosxi/versions.php https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and •
CVSS: 9.0EPSS: 96%CPEs: 1EXPL: 5CVE-2021-25297 – Nagios XI OS Command Injection
https://notcve.org/view.php?id=CVE-2021-25297
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. Nagios XI versión xi-5.7.5, esta afectada por una inyección de comandos del Sistema Operativo. La vulnerabilidad se presenta en el archivo /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php debido a un saneamiento inapropiado de la entrada controlada por el usuario autenticado mediante una única petición HTTP, lo que puede conllevar a una inyección de comandos del sistema operativo en el servidor de Nagios XI Nagios XI version 5.7.5 suffers from a cross site scripting and multiple remote code execution vulnerabilities. Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. • http://nagios.com http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html https://assets.nagios.com/downloads/nagiosxi/versions.php https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and •
CVSS: 9.0EPSS: 96%CPEs: 1EXPL: 4CVE-2021-25298 – Nagios XI OS Command Injection
https://notcve.org/view.php?id=CVE-2021-25298
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. Nagios XI versión xi-5.7.5, esta afectada por una inyección de comandos del Sistema Operativo. La vulnerabilidad se presenta en el archivo /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php debido a un saneamiento inapropiado de la entrada controlada por el usuario autenticado mediante una única petición HTTP, lo que puede conducir a una inyección de comandos del Sistema Operativo en el servidor de Nagios XI Nagios XI version 5.7.5 suffers from a cross site scripting and multiple remote code execution vulnerabilities. Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server. • http://nagios.com http://packetstormsecurity.com/files/161561/Nagios-XI-5.7.5-Remote-Code-Execution.html http://packetstormsecurity.com/files/170924/Nagios-XI-5.7.5-Remote-Code-Execution.html https://assets.nagios.com/downloads/nagiosxi/versions.php https://github.com/fs0c-sh/nagios-xi-5.7.5-bugs/blob/main/README.md https://www.fastly.com/blog/anatomy-of-a-command-injection-cve-2021-25296-7-8-with-metasploit-module-and •