CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 2CVE-2018-13441 – Nagios Core 4.4.1 - Denial of Service
https://notcve.org/view.php?id=CVE-2018-13441
qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by sending a crafted payload to the listening UNIX socket. qh_help en Nagios Core en versiones 4.4.1 y anteriores es propenso a una vulnerabilidad de desreferencia de puntero NULL que permite que un atacante provoque una condición de denegación de servicio (DoS) local mediante el envío de una carga útil manipulada al socket UNIX en escucha. Nagios Core versions 4.4.1 and below suffer from a denial of service vulnerability. • https://www.exploit-db.com/exploits/45082 http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html https://gist.github.com/fakhrizulkifli/8df4a174158df69ebd765f824bd736b8 https://knowledge.opsview.com/v5.3/docs/whats-new https://knowledge.opsview.com/v5.4/docs/whats-new • CWE-476: NULL Pointer Dereference •
CVSS: 6.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12847
https://notcve.org/view.php?id=CVE-2017-12847
Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for nagios.lock modification before a root script executes a "kill `cat /pathname/nagios.lock`" command. Nagios Core en versiones anteriores a la 4.3.3 crea un archivo nagios.lock PID tras eliminar privilegios a una cuenta no-root, lo que podría permitir que usuarios locales terminen procesos arbitrarios aprovechando el acceso a esta cuenta no-root para modificar nagios.lock antes de que un script root ejecute un comando "kill `cat /pathname/nagios.lock`". • http://www.securityfocus.com/bid/100403 https://github.com/NagiosEnterprises/nagioscore/blob/master/Changelog https://github.com/NagiosEnterprises/nagioscore/commit/1b197346d490df2e2d3b1dcce5ac6134ad0c8752 https://github.com/NagiosEnterprises/nagioscore/commit/3baffa78bafebbbdf9f448890ba5a952ea2d73cb https://github.com/NagiosEnterprises/nagioscore/issues/404 https://security.gentoo.org/glsa/201710-20 • CWE-665: Improper Initialization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10089
https://notcve.org/view.php?id=CVE-2016-10089
Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641. Nagios 4.3.2 y anteriores permite a los usuarios locales obtener privilegios root mediante un ataque de vínculo físico en el archivo de script init de Nagios. Esta vulnerabilidad está relacionada con CVE-2016-8641. • http://www.openwall.com/lists/oss-security/2016/12/30/6 http://www.securityfocus.com/bid/95171 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2008-7313 – snoopy: incomplete fixes for command execution flaws
https://notcve.org/view.php?id=CVE-2008-7313
The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796. La función _httpsrequest en Snoopy permite a atacantes remotos ejecutar comandos arbitrarios. NOTA: este problema existe debido a una solución incompleta para CVE-2008-4796. Various command-execution flaws were found in the Snoopy library included with Nagios. • http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.27 http://www.openwall.com/lists/oss-security/2014/07/09/11 http://www.openwall.com/lists/oss-security/2014/07/16/10 http://www.openwall.com/lists/oss-security/2014/07/18/2 http://www.securityfocus.com/bid/68776 https://bugzilla.redhat.com/show_bug.cgi?id=1121497 https://exchange.xforce.ibmcloud.com/vulnerabilities/94737 https://rhn.redhat.com/errata/RHSA-2017-0211.html https:/ • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2014-5009 – snoopy: incomplete fixes for command execution flaws
https://notcve.org/view.php?id=CVE-2014-5009
Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008. Snoopy permite a atacantes remotos ejecutar comandos arbitrarios. NOTA: esta vulnerabilidad existe debido a una corrección incompleta para CVE-2014-5008. Various command-execution flaws were found in the Snoopy library included with Nagios. • http://rhn.redhat.com/errata/RHSA-2017-0211.html http://rhn.redhat.com/errata/RHSA-2017-0212.html http://rhn.redhat.com/errata/RHSA-2017-0213.html http://rhn.redhat.com/errata/RHSA-2017-0214.html http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?r1=1.28&r2=1.29 http://www.openwall.com/lists/oss-security/2014/07/09/11 http://www.openwall.com/lists/oss-security/2014/07/16/10 http://www.openwall.com/lists/oss-security/2014/07/18 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •