Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Nagios_xi
(Nagios)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 106 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2020-03-22 | CVE-2020-10819 | Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter. | Nagios_xi | N/A | ||
| 2019-12-31 | CVE-2019-20197 | In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account. | Nagios_xi | N/A | ||
| 2019-12-30 | CVE-2019-20139 | In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user. | Nagios_xi | N/A | ||
| 2019-07-10 | CVE-2018-17147 | Nagios XI before 5.5.4 has XSS in the auto login admin management page. | Nagios_xi | 4.8 | ||
| 2018-11-14 | CVE-2018-15710 | Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. | Nagios_xi | 7.8 | ||
| 2018-11-14 | CVE-2018-15708 | Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. | Nagios_xi | 9.8 | ||
| 2019-06-19 | CVE-2018-17146 | A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page. | Nagios_xi | 5.4 | ||
| 2019-06-19 | CVE-2018-17148 | An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials. | Nagios_xi | 9.8 | ||
| 2018-04-17 | CVE-2018-8736 | A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root. | Nagios_xi | 8.8 | ||
| 2018-04-17 | CVE-2018-8735 | Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection. | Nagios_xi | 8.8 |