SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.
8.7AI Score
0.661EPSS
An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings.
6.5CVSS
6.2AI Score
0.001EPSS
An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime.php, related to the update_pages function; (3) the ajaxhelp...
5.4CVSS
5.5AI Score
0.001EPSS
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.
7.2CVSS
7.5AI Score
0.037EPSS
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.
7.2CVSS
7.5AI Score
0.037EPSS
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.
7.2CVSS
7.5AI Score
0.037EPSS
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.
7.2CVSS
7.5AI Score
0.037EPSS
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.
9.8CVSS
9.5AI Score
0.431EPSS
Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.
8.8CVSS
8.6AI Score
0.042EPSS
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.
7.8CVSS
8.3AI Score
0.058EPSS
Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.
8.8CVSS
8.4AI Score
0.275EPSS
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php.
6.1CVSS
6.4AI Score
0.217EPSS
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.
5.4CVSS
5.9AI Score
0.004EPSS
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.
6.1CVSS
6.8AI Score
0.217EPSS
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.
5.4CVSS
5.4AI Score
0.002EPSS
4.8CVSS
4.8AI Score
0.002EPSS
An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.
9.8CVSS
9.5AI Score
0.006EPSS
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.
6.1CVSS
5.9AI Score
0.002EPSS
An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.
6.1CVSS
5.9AI Score
0.002EPSS
Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability.
9.8CVSS
9.4AI Score
0.32EPSS
SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.
9.8CVSS
9.6AI Score
0.101EPSS
Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands on the target system, aka OS command injection.
8.8CVSS
9.1AI Score
0.633EPSS
A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability escalating to root.
8.8CVSS
8.6AI Score
0.222EPSS
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that ...
9.8CVSS
9.8AI Score
0.014EPSS
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a pa...
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.
5.4CVSS
5.1AI Score
0.056EPSS
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
8.8CVSS
8.9AI Score
0.008EPSS
Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.
8.8CVSS
8.9AI Score
0.027EPSS
SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id.
9.8CVSS
9.9AI Score
0.008EPSS
Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php.
7.8CVSS
8.2AI Score
0.001EPSS
Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter.
6.1CVSS
6AI Score
0.106EPSS
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
4.8CVSS
4.9AI Score
0.052EPSS
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
4.8CVSS
5.2AI Score
0.052EPSS
4.8CVSS
5.1AI Score
0.052EPSS
In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
8.8CVSS
9AI Score
0.07EPSS
6.1CVSS
5.9AI Score
0.01EPSS
An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3.
9.8CVSS
9.5AI Score
0.002EPSS
NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted, and the only option is ...
7.2CVSS
7.4AI Score
0.003EPSS
Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request.
6.1CVSS
6.1AI Score
0.001EPSS
Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.
8.8CVSS
9AI Score
0.004EPSS
5.4CVSS
5.2AI Score
0.036EPSS
5.4CVSS
5.2AI Score
0.036EPSS
5.4CVSS
5.2AI Score
0.036EPSS
5.4CVSS
5.2AI Score
0.036EPSS
Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.
8.8CVSS
8.6AI Score
0.141EPSS
Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.
9.8CVSS
9.4AI Score
0.065EPSS
Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root.
8.8CVSS
9AI Score
0.003EPSS
Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getprofile.sh.
9.8CVSS
9.4AI Score
0.08EPSS
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.
7.2CVSS
6.8AI Score
0.947EPSS
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
6.5CVSS
6.4AI Score
0.001EPSS