Nagios: >> Nagios Xi >> 5.5.6 Security Vulnerabilities
Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.
CVSS Score
8.8
EPSS Score
0.317
Published
2018-11-14
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php.
CVSS Score
6.1
EPSS Score
0.268
Published
2018-11-14
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.
CVSS Score
5.4
EPSS Score
0.037
Published
2018-11-14
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.
CVSS Score
6.1
EPSS Score
0.214
Published
2018-11-14
SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.
CVSS Score
7.5
EPSS Score
0.197
Published
2013-11-26
Page 14