CVSS: 9.8EPSS: 25%CPEs: 1EXPL: 3CVE-2019-12279 – Nagios XI 5.6.1 - SQL injection
https://notcve.org/view.php?id=CVE-2019-12279
22 May 2019 — Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the ... • https://packetstorm.news/files/id/153040 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 25%CPEs: 1EXPL: 2CVE-2019-9167 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9167
28 Mar 2019 — Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter. Una vulnerabilidad de Cross-Site Scripting (XSS) en Nagios XI, en versiones anteriores a la 5.5.11, permite a los atacantes inyectar scripts web o HTML arbitrarios mediante el parámetro xiwindow. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with "autodiscovery job" c... • https://packetstorm.news/files/id/152496 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-9166 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9166
28 Mar 2019 — Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php. Un escalado de privilegios en Nagios XI, en versiones anteriores a la 5.5.11, permite a los atacantes local elevar privilegios a root mediante un acceso de escritura en config.inc.php en import_xiconfig.php. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with ... • https://packetstorm.news/files/id/152496 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 9%CPEs: 1EXPL: 2CVE-2019-9165 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9165
28 Mar 2019 — SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id. Una vulnerabilidad de inyección SQL en Nagios XI, en versiones anteriores a la 5.5.11, permite a los atacantes ejecutar comandos SQL arbitrarios mediante la API cuando se utilizan "fusekeys" y un ID de usuario maliciosos. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated... • https://packetstorm.news/files/id/152496 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 37%CPEs: 1EXPL: 3CVE-2019-9164 – Nagios XI 5.5.10 XSS / Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9164
28 Mar 2019 — Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. Una inyección de comandos en Nagios XI, en versiones anteriores a la 5.5.11, permite a los usuarios autenticados ejecutar comandos remotos arbitrarios mediante un nuevo trabajo de autodescubrimiento. Various vulnerabilities have been found in Nagios XI version 5.5.10, which allow a remote attacker able to trick an authenticated victim (with "autodiscovery job" creation... • https://packetstorm.news/files/id/152496 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 3%CPEs: 1EXPL: 1CVE-2018-20171
https://notcve.org/view.php?id=CVE-2018-20171
17 Dec 2018 — An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability. Se ha descubierto un problema en versiones anteriores a la 5.5.8 de Nagios XI. El parámetro url en rss_dashlet/magpierss/scripts/magpie_simple.php no está filtrado, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS) • https://www.nagios.com/downloads/nagios-xi/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 3%CPEs: 1EXPL: 1CVE-2018-20172
https://notcve.org/view.php?id=CVE-2018-20172
17 Dec 2018 — An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability. Se ha descubierto un problema en versiones anteriores a la 5.5.8 de Nagios XI. El parámetro rss_url en rss_dashlet/magpierss/scripts/magpie_slashbox.php no está filtrado, lo que resulta en una vulnerabilidad Cross-Site Scripting (XSS). • https://www.nagios.com/downloads/nagios-xi/change-log • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 92%CPEs: 1EXPL: 6CVE-2018-15708 – Nagios XI 5.5.6 - Magpie_debug.php Root Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-15708
14 Nov 2018 — Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. Snoopy 1.0 en Nagios XI 5.5.6 permite que atacantes remotos no autenticados ejecuten comandos arbitrarios mediante una petición HTTP manipulada. Nagios XI version 5.5.6 suffers from remote code execution and privilege escalation vulnerabilities. • https://packetstorm.news/files/id/151296 •
CVSS: 8.8EPSS: 11%CPEs: 1EXPL: 1CVE-2018-15709
https://notcve.org/view.php?id=CVE-2018-15709
14 Nov 2018 — Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request. Nagios XI 5.5.6 permite que atacantes remotos autenticados ejecuten comandos arbitrarios mediante una petición HTTP manipulada. • https://www.tenable.com/security/research/tra-2018-37 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 79%CPEs: 1EXPL: 5CVE-2018-15710 – Nagios XI 5.5.6 - Magpie_debug.php Root Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-15710
14 Nov 2018 — Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. Nagios XI 5.5.6 permite que atacantes autenticados locales escalen privilegios a root mediante Autodiscover_new.php. Nagios XI version 5.5.6 suffers from remote code execution and privilege escalation vulnerabilities. • https://packetstorm.news/files/id/151296 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •