Nagios: Security Vulnerabilities
A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.
CVSS Score
5.4
EPSS Score
0.066
Published
2020-07-30
In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
CVSS Score
8.8
EPSS Score
0.39
Published
2020-07-22
Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
CVSS Score
6.1
EPSS Score
0.428
Published
2020-07-22
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.
CVSS Score
4.9
EPSS Score
0.019
Published
2020-06-09
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
CVSS Score
4.8
EPSS Score
0.242
Published
2020-03-22
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
CVSS Score
4.8
EPSS Score
0.045
Published
2020-03-22
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
CVSS Score
4.8
EPSS Score
0.242
Published
2020-03-22
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.
CVSS Score
7.3
EPSS Score
0.002
Published
2020-03-16
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
CVSS Score
7.5
EPSS Score
0.016
Published
2020-03-16
Nagios Log Server 2.1.3 has Incorrect Access Control.
CVSS Score
6.5
EPSS Score
0.005
Published
2020-03-16