CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2021-26024
https://notcve.org/view.php?id=CVE-2021-26024
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account. El plugin Favorites versiones anteriores a 1.0.2 para Nagios XI versión 5.8.0, es vulnerable a una Referencia Directa a Objetos No Segura: es posible crear favoritos para cualquier otra cuenta de usuario • https://www.nagios.com/products/security • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2021-26023
https://notcve.org/view.php?id=CVE-2021-26023
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS. El plugin Favorites versiones anteriores a 1.0.2 para Nagios XI versión 5.8.0, es vulnerable a un ataque de tipo XSS • https://www.nagios.com/products/security • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-3193
https://notcve.org/view.php?id=CVE-2021-3193
Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user. Un acceso inapropiado y una comprobación de comandos en el asistente de configuración de Docker de Nagios XI versiones anteriores a 5.8.0, permiten a un atacante autenticado ejecutar código remoto como el usuario de Apache • https://www.nagios.com/products/security •
CVSS: 9.0EPSS: 94%CPEs: 1EXPL: 3CVE-2020-35578 – Nagios XI 5.7.X - Remote Code Execution RCE (Authenticated)
https://notcve.org/view.php?id=CVE-2020-35578
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands. Se detectó un problema en la página Manage Plugins en Nagios XI versiones anteriores a 5.8.0. Debido a que la funcionalidad line-ending conversion es manejada inapropiadamente durante la carga de un plugin, un usuario administrador autenticado y remoto puede ejecutar comandos del sistema operativo. • https://www.exploit-db.com/exploits/49422 http://packetstormsecurity.com/files/160948/Nagios-XI-5.7.x-Remote-Code-Execution.html http://packetstormsecurity.com/files/162207/Nagios-XI-Remote-Code-Execution.html https://www.nagios.com/downloads/nagios-xi/change-log https://www.nagios.com/products/security - • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 3%CPEs: 1EXPL: 0CVE-2020-27991
https://notcve.org/view.php?id=CVE-2020-27991
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). Nagios XI versiones anteriores a 5.7.5, es vulnerable a un ataque de tipo XSS en Account Information (campo Email) • https://www.nagios.com/downloads/nagios-xi/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •