CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-22043
https://notcve.org/view.php?id=CVE-2021-22043
16 Feb 2022 — VMware ESXi contains a TOCTOU (Time-of-check Time-of-use) vulnerability that exists in the way temporary files are handled. A malicious actor with access to settingsd, may exploit this issue to escalate their privileges by writing arbitrary files. VMware ESXi contiene una vulnerabilidad TOCTOU (Time-of-check Time-of-use) que se presenta en la forma de manejar los archivos temporales. Un actor malicioso con acceso a settingsd, puede explotar este problema para escalar sus privilegios al escribir archivos arb... • https://www.vmware.com/security/advisories/VMSA-2022-0004.html • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 6.5EPSS: 2%CPEs: 1EXPL: 2CVE-2020-28911 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28911
24 May 2021 — Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php. Un Control de Acceso Incorrecto en Nagios Fusion versiones 4.1.8 y anteriores, permite a usuarios autenticados pocos privilegiados extraer las contraseñas usadas para administrar servidores fusionados por medio del comando test_server en el archivo ajaxhelper.php Skylight Cyber has identified a total of 13 vulne... • https://packetstorm.news/files/id/162783 • CWE-922: Insecure Storage of Sensitive Information •
CVSS: 9.0EPSS: 8%CPEs: 1EXPL: 2CVE-2020-28909 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28909
24 May 2021 — Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo. Los Permisos de Archivo Incorrectos en Nagios Fusion versiones 4.1.8 y anteriores, permiten una Escalada de Privilegios a root por medio de la modificación de los scripts. Los usuarios pocos privilegiados pueden modificar archivos que pueden ser ejecutados por sudo Skylight Cyber has identified a to... • https://packetstorm.news/files/id/162783 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 16%CPEs: 1EXPL: 2CVE-2020-28908 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28908
24 May 2021 — Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. Una Inyección de Comandos en Nagios Fusion versiones 4.1.8 y anteriores, permite una Escalada de Privilegios en nagios Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include remote code execution, cross site scripting, privilege escalation, and more. • https://packetstorm.news/files/id/162783 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 6%CPEs: 1EXPL: 2CVE-2020-28907 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28907
24 May 2021 — Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh. Una comprobación incorrecta del certificado SSL en Nagios Fusion versiones 4.1.8 y anteriores, permite una Escalada de Privilegios o una Ejecución de Código como root por medio de vectores relacionados con la descarga de un paquete de actualización que no es confiable en upgrade_to_latest.... • https://packetstorm.news/files/id/162783 • CWE-295: Improper Certificate Validation •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2020-28906 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28906
24 May 2021 — Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root. Los Permisos de Archivo Incorrectos en Nagios XI versiones 5.7.5 y anteriores y Nagios Fusion versiones 4.1.8 y anteriores, permiten una Escalada de Privilegios a root. Los usuarios pocos privilegiados pueden modificar archivos que son incluidos (también se conoce ... • https://packetstorm.news/files/id/162783 • CWE-276: Incorrect Default Permissions •
CVSS: 8.8EPSS: 11%CPEs: 1EXPL: 2CVE-2020-28905 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28905
24 May 2021 — Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination. Una Comprobación Inapropiada de la Entrada en Nagios Fusion versiones 4.1.8 y anteriores, permite a un atacante autenticado ejecutar código remoto por medio de una paginación de tabla Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include remote code execution, cross site scripting, privilege escalation, and more... • https://packetstorm.news/files/id/162783 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 12%CPEs: 1EXPL: 2CVE-2020-28904 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28904
24 May 2021 — Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code. Una Ejecución con Privilegios Innecesarios en Nagios Fusion versiones 4.1.8 y anteriores, permite una Escalada de Privilegios como nagios por medio de la instalación de un componente malicioso que contiene código PHP Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include rem... • https://packetstorm.news/files/id/162783 • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2020-28903 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28903
24 May 2021 — Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS. Una Comprobación Inapropiada de la Entrada en Nagios Fusion versiones 4.1.8 y anteriores, permite a un atacante remoto con control sobre un servidor fusionado inyectar HTML arbitrario, también se conoce como XSS Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include remote code execution, cross sit... • https://packetstorm.news/files/id/162783 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 16%CPEs: 1EXPL: 2CVE-2020-28902 – Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution
https://notcve.org/view.php?id=CVE-2020-28902
24 May 2021 — Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php. Una Inyección de Comandos en Nagios Fusion versiones 4.1.8 y anteriores, permite la escalada de privilegios de apache a root en el archivo cmd_subsys.php Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include remote code execution, cross site scripting, privilege escalation, and more. • https://packetstorm.news/files/id/162783 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •