Product:

Nagios_xi

(Nagios)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 103
Date Id Summary Products Score Patch Annotated
2022-09-07 CVE-2022-38254 Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5. Nagios_xi 6.1
2023-08-22 CVE-2020-23992 Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request. Nagios_xi 6.1
2023-09-19 CVE-2023-40931 A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php Nagios_xi 6.5
2023-09-19 CVE-2023-40932 A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom logo component to inject arbitrary javascript or HTML via the alt-text field. This affects all pages containing the navbar including the login page which means the attacker is able to to steal plaintext credentials. Nagios_xi 5.4
2023-09-19 CVE-2023-40933 A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the update_banner_message() function. Nagios_xi 8.8
2023-09-19 CVE-2023-40934 A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the Core Configuration Manager to execute arbitrary SQL commands via the host escalation notification settings. Nagios_xi 7.2
2023-12-14 CVE-2023-48084 Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. Nagios_xi 9.8
2019-05-22 CVE-2019-12279 Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried... Nagios_xi 9.8
2019-03-28 CVE-2019-9164 Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. Nagios_xi 8.8
2019-03-28 CVE-2019-9165 SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id. Nagios_xi 9.8