CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3193
https://notcve.org/view.php?id=CVE-2021-3193
Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user. Un acceso inapropiado y una comprobación de comandos en el asistente de configuración de Docker de Nagios XI versiones anteriores a 5.8.0, permiten a un atacante autenticado ejecutar código remoto como el usuario de Apache • https://www.nagios.com/products/security •
CVSS: 9.0EPSS: 94%CPEs: 1EXPL: 3CVE-2020-35578 – Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated)
https://notcve.org/view.php?id=CVE-2020-35578
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands. Se detectó un problema en la página Manage Plugins en Nagios XI versiones anteriores a 5.8.0. Debido a que la funcionalidad line-ending conversion es manejada inapropiadamente durante la carga de un plugin, un usuario administrador autenticado y remoto puede ejecutar comandos del sistema operativo. • https://www.exploit-db.com/exploits/49422 http://packetstormsecurity.com/files/160948/Nagios-XI-5.7.x-Remote-Code-Execution.html http://packetstormsecurity.com/files/162207/Nagios-XI-Remote-Code-Execution.html https://www.nagios.com/downloads/nagios-xi/change-log https://www.nagios.com/products/security - • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 3%CPEs: 1EXPL: 0CVE-2020-27991
https://notcve.org/view.php?id=CVE-2020-27991
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). Nagios XI versiones anteriores a 5.7.5, es vulnerable a un ataque de tipo XSS en Account Information (campo Email) • https://www.nagios.com/downloads/nagios-xi/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 3%CPEs: 1EXPL: 0CVE-2020-27990
https://notcve.org/view.php?id=CVE-2020-27990
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). Nagios XI versiones anteriores a 5.7.5, es vulnerable a un ataque de tipo XSS en la herramienta Deployment (add agent) • https://www.nagios.com/downloads/nagios-xi/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 3%CPEs: 1EXPL: 0CVE-2020-27989
https://notcve.org/view.php?id=CVE-2020-27989
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). Nagios XI versiones anteriores a 5.7.5, es vulnerable a un ataque de tipo XSS en Dashboard Tools (Panel Edit) • https://www.nagios.com/downloads/nagios-xi/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •