CVSS: 7.2EPSS: 53%CPEs: 1EXPL: 2CVE-2020-5792 – Nagios XI 5.7.3 Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-5792
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user. Una neutralización inapropiada de los delimitadores de argumentos en un comando en Nagios XI versión 5.7.3, permite a un usuario administrador autenticado remoto escribir en archivos arbitrarios y finalmente ejecutar código con los privilegios del usuario de apache • http://packetstormsecurity.com/files/162284/Nagios-XI-5.7.3-Remote-Code-Execution.html https://www.tenable.com/security/research/tra-2020-58 - • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.5EPSS: 60%CPEs: 17EXPL: 2CVE-2013-6875 – Nagios XI - 'tfPassword' SQL Injection
https://notcve.org/view.php?id=CVE-2013-6875
SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php. Vulnerabilidad de inyección de SQL en functions/prepend_adm.php de Nagios Core Config Manager de Nagios XI anterior a la versión 2012R2.4 permite a atacantes remotos ejecutar comandos SQL a través del parámetro tfPassword hacia nagiosql/index.php. • https://www.exploit-db.com/exploits/38827 http://assets.nagios.com/downloads/nagiosxi/CHANGES-2012.TXT http://secunia.com/advisories/55695 http://www.security-assessment.com/files/documents/advisory/NagiosQL%20Core%20Config%20Manager%20SQL%20Injection%20Vulnerability%20Advisory%20-%20DA.pdf • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •