Nagios: >> Nagios Xi Security Vulnerabilities
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/banner_message-ajaxhelper.php
CVSS Score
6.5
EPSS Score
0.119
Published
2023-09-19
Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request.
CVSS Score
6.1
EPSS Score
0.025
Published
2023-08-22
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel.
CVSS Score
4.8
EPSS Score
0.021
Published
2022-09-07
Nagios XI before v5.8.7 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at auditlog.php.
CVSS Score
6.1
EPSS Score
0.021
Published
2022-09-07
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the MTR component in version 1.0.4.
CVSS Score
6.1
EPSS Score
0.021
Published
2022-09-07
Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page.
CVSS Score
9.8
EPSS Score
0.03
Published
2022-09-07
Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel.
CVSS Score
4.8
EPSS Score
0.021
Published
2022-09-07
Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5.
CVSS Score
6.1
EPSS Score
0.021
Published
2022-09-07
In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that lead to the reformatting/editing of emails from an official email address.
CVSS Score
6.5
EPSS Score
0.03
Published
2022-06-29
In Nagios XI through 5.8.5, it is possible for a user without password verification to change his e-mail address.
CVSS Score
4.3
EPSS Score
0.034
Published
2022-06-29