Nagios
Page 3 of 4 — Nagios CVEs from a corpus of 301, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27991 | Medium | 5.4 | 2020-11-16 | Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). |
CVE-2020-27990 | Medium | 5.4 | 2020-11-16 | Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). |
CVE-2020-27989 | Medium | 5.4 | 2020-11-16 | Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). |
CVE-2020-27988 | Medium | 5.4 | 2020-11-16 | Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). |
CVE-2020-28648 | High | 8.8 | 2020-11-16 | Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code. |
CVE-2020-5796 | High | 7.8 | 2020-11-13 | Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low… |
CVE-2020-5792 | High | 7.2 | 2020-10-20 | Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultima… |
CVE-2020-5791 | High | 7.2 | 2020-10-20 | Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system comm… |
CVE-2020-5790 | Medium | 6.5 | 2020-10-20 | Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a cr… |
CVE-2020-15903 | Critical | 9.8 | 2020-09-09 | An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were… |
CVE-2020-16157 | Medium | 5.4 | 2020-07-30 | A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu. |
CVE-2020-15902 | Medium | 6.1 | 2020-07-22 | Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option. |
CVE-2020-15901 | High | 8.8 | 2020-07-22 | In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys. |
CVE-2020-13977 | Medium | 4.9 | 2020-06-09 | Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram a… |
CVE-2020-10821 | Medium | 4.8 | 2020-03-22 | Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter. |
CVE-2020-10820 | Medium | 4.8 | 2020-03-22 | Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter. |
CVE-2020-10819 | Medium | 4.8 | 2020-03-22 | Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter. |
CVE-2020-6582 | High | 7.5 | 2020-03-16 | Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call. |
CVE-2020-6581 | High | 7.3 | 2020-03-16 | Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline… |
CVE-2020-6586 | Medium | 5.4 | 2020-03-16 | Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with… |
CVE-2020-6585 | High | 8.8 | 2020-03-16 | Nagios Log Server 2.1.3 has CSRF. |
CVE-2020-6584 | Medium | 6.5 | 2020-03-16 | Nagios Log Server 2.1.3 has Incorrect Access Control. |
CVE-2019-3698 | Medium | 5.7 | 2020-02-28 | UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; op… |
CVE-2019-20197 | High | 8.8 | 2019-12-31 | In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the c… |
CVE-2019-20139 | Medium | 5.4 | 2019-12-30 | In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any… |
CVE-2019-15949 | High | 8.8 | 2019-09-05 | Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via t… |
CVE-2019-15898 | Medium | 6.1 | 2019-09-03 | Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page. |
CVE-2018-17147 | Medium | 4.8 | 2019-07-10 | Nagios XI before 5.5.4 has XSS in the auto login admin management page. |
CVE-2018-17148 | Critical | 9.8 | 2019-06-19 | An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before… |
CVE-2018-17146 | Medium | 5.4 | 2019-06-19 | A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulner… |
CVE-2019-12279 | Critical | 9.8 | 2019-05-22 | Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as… |
CVE-2019-9167 | Medium | 6.1 | 2019-03-28 | Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter. |
CVE-2019-9166 | High | 7.8 | 2019-03-28 | Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php. |
CVE-2019-9204 | Critical | 9.8 | 2019-03-28 | SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands. |
CVE-2019-9203 | Critical | 9.8 | 2019-03-28 | Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API. |
CVE-2019-9202 | High | 8.8 | 2019-03-28 | Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues. |
CVE-2019-9165 | Critical | 9.8 | 2019-03-28 | SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id. |
CVE-2019-9164 | High | 8.8 | 2019-03-28 | Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. |
CVE-2018-20172 | Medium | 6.1 | 2018-12-17 | An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an… |
CVE-2018-20171 | Medium | 6.1 | 2018-12-17 | An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vu… |
CVE-2018-18245 | Medium | 5.4 | 2018-12-17 | Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRP… |
CVE-2018-15714 | Medium | 6.1 | 2018-11-14 | Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters. |
CVE-2018-15713 | Medium | 5.4 | 2018-11-14 | Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php. |
CVE-2018-15712 | Medium | 6.1 | 2018-11-14 | Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php. |
CVE-2018-15711 | High | 8.8 | 2018-11-14 | Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key t… |
CVE-2018-15710 | High | 7.8 | 2018-11-14 | Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php. |
CVE-2018-15709 | High | 8.8 | 2018-11-14 | Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2018-15708 | Critical | 9.8 | 2018-11-14 | Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. |
CVE-2016-8641 | Medium | 6.7 | 2018-08-01 | A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownershi… |
CVE-2018-13458 | Medium | 5.5 | 2018-07-12 | qh_core in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condit… |
CVE-2018-13457 | Medium | 5.5 | 2018-07-12 | qh_echo in Nagios Core 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attackers to cause a local denial-of-service condit… |
CVE-2018-13441 | Medium | 5.5 | 2018-07-12 | qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service… |
CVE-2018-12501 | Medium | 6.1 | 2018-06-16 | Nagios Fusion before 4.1.4 has XSS, aka TPS#13332-13335. |
CVE-2018-10738 | High | 7.2 | 2018-05-16 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter. |
CVE-2018-10737 | High | 7.2 | 2018-05-16 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter. |
CVE-2018-10736 | High | 7.2 | 2018-05-16 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter. |
CVE-2018-10735 | High | 7.2 | 2018-05-16 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter. |
CVE-2018-10554 | Medium | 5.4 | 2018-04-30 | An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, r… |
CVE-2018-10553 | Medium | 6.5 | 2018-04-30 | An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with i… |
CVE-2018-8736 | High | 8.8 | 2018-04-18 | A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root. |
CVE-2018-8735 | High | 8.8 | 2018-04-18 | Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target syst… |
CVE-2018-8734 | Critical | 9.8 | 2018-04-18 | SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via… |
CVE-2018-8733 | Critical | 9.8 | 2018-04-18 | Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make config… |
CVE-2015-3618 | Medium | 6.1 | 2018-02-06 | Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitrary web script or H… |
CVE-2017-14312 | High | 7.8 | 2017-09-11 | Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account (and… |
CVE-2017-12847 | Medium | 6.3 | 2017-08-23 | Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary proces… |
CVE-2016-0726 | Critical | 9.8 | 2017-06-06 | The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to… |
CVE-2016-6209 | Medium | 6.1 | 2017-03-31 | Cross-site scripting (XSS) vulnerability in Nagios. |
CVE-2014-5009 | Critical | 9.8 | 2017-03-31 | Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008. |
CVE-2008-7313 | Critical | 9.8 | 2017-03-31 | The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-479… |
CVE-2016-10089 | High | 7.8 | 2017-02-15 | Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641. |
CVE-2016-9566 | High | 7.8 | 2016-12-15 | base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the… |
CVE-2016-9565 | Critical | 9.8 | 2016-12-15 | MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafte… |
CVE-2014-4703 | | 2014-12-05 | lib/parse_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts fla… | |
CVE-2014-4702 | | 2014-12-05 | The check_icmp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a… | |
CVE-2014-4701 | | 2014-12-05 | The check_dhcp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a… | |
CVE-2014-2913 | | 2014-05-07 | Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via… | |
CVE-2013-4215 | | 2014-05-05 | The IPXPING_COMMAND in contrib/check_ipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/ipxping/ipxping. | |
CVE-2014-1878 | | 2014-02-28 | Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5… | |
CVE-2013-2214 | | 2014-02-10 | status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allow… | |
CVE-2013-7205 | | 2014-01-15 | Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain se… | |
CVE-2013-7108 | | 2014-01-15 | Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticat… | |
CVE-2013-6875 | | 2013-11-26 | SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrar… | |
CVE-2013-4214 | | 2013-11-23 | rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink atta… | |
CVE-2013-1362 | | 2013-07-09 | Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell comma… | |
CVE-2012-6096 | | 2013-01-22 | Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4… | |
CVE-2011-2179 | | 2011-06-14 | Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject… | |
CVE-2011-1523 | | 2011-05-03 | Cross-site scripting (XSS) vulnerability in statusmap.c in statusmap.cgi in Nagios 3.2.3 and earlier allows remote attackers to inject arbitrary web script or… | |
CVE-2009-2288 | | 2009-07-01 | statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameter… | |
CVE-2008-6373 | | 2009-03-02 | Unspecified vulnerability in Nagios before 3.0.6 has unspecified impact and remote attack vectors related to CGI programs, "adaptive external commands," and "w… | |
CVE-2008-5028 | | 2008-11-10 | Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the… | |
CVE-2008-5027 | | 2008-11-10 | The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger ex… | |
CVE-2008-4796 | | 2008-10-30 | The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) ope… | |
CVE-2007-5803 | | 2008-05-13 | Multiple cross-site scripting (XSS) vulnerabilities in CGI programs in Nagios before 2.12 might allow remote attackers to inject arbitrary web script or HTML v… | |
CVE-2008-1360 | | 2008-03-17 | Cross-site scripting (XSS) vulnerability in Nagios before 2.11 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecifie… | |
CVE-2007-5624 | | 2007-10-23 | Cross-site scripting (XSS) vulnerability in Nagios 2.x before 2.10 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspec… | |
CVE-2007-5623 | | 2007-10-23 | Buffer overflow in the check_snmp function in Nagios Plugins (nagios-plugins) 1.4.10 allows remote attackers to cause a denial of service (crash) via crafted s… | |
CVE-2007-5198 | | 2007-10-04 | Buffer overflow in the redir function in check_http.c in Nagios Plugins before 1.4.10, when running with the -f (follow) option, allows remote web servers to e… | |
CVE-2006-2489 | | 2006-05-19 | Integer overflow in CGI scripts in Nagios 1.x before 1.4.1 and 2.x before 2.3.1 allows remote attackers to cause a denial of service (crash) and possibly execu… | |
CVE-2006-2162 | | 2006-05-03 | Buffer overflow in CGI scripts in Nagios 1.x before 1.4 and 2.x before 2.3 allows remote attackers to execute arbitrary code via a negative content length (Con… |