Nagios: Security Vulnerabilities
A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.
CVSS Score
5.4
EPSS Score
0.144
Published
2020-07-30
In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
CVSS Score
8.8
EPSS Score
0.385
Published
2020-07-22
Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
CVSS Score
6.1
EPSS Score
0.563
Published
2020-07-22
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.
CVSS Score
4.9
EPSS Score
0.029
Published
2020-06-09
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
CVSS Score
4.8
EPSS Score
0.738
Published
2020-03-22
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
CVSS Score
4.8
EPSS Score
0.301
Published
2020-03-22
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
CVSS Score
4.8
EPSS Score
0.736
Published
2020-03-22
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.
CVSS Score
7.3
EPSS Score
0.016
Published
2020-03-16
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
CVSS Score
7.5
EPSS Score
0.039
Published
2020-03-16
Nagios Log Server 2.1.3 has Incorrect Access Control.
CVSS Score
6.5
EPSS Score
0.039
Published
2020-03-16