CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Nagios : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2021-40345 77 Exec Code 2021-10-26 2021-11-01
9.0
None Remote Low ??? Complete Complete Complete
An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.
2 CVE-2021-40344 434 Exec Code 2021-10-26 2021-11-02
6.5
None Remote Low ??? Partial Partial Partial
An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution.
3 CVE-2021-40343 732 2021-10-26 2021-11-01
7.2
None Local Low Not required Complete Complete Complete
An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios user to elevate their privileges to the root user.
4 CVE-2021-38156 79 XSS 2021-09-15 2021-09-27
3.5
None Remote Medium ??? None Partial None
In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.
5 CVE-2021-37353 918 2021-08-13 2021-08-24
7.5
None Remote Low Not required Partial Partial Partial
Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php.
6 CVE-2021-37352 601 2021-08-13 2021-08-23
5.8
None Remote Medium Not required Partial Partial None
An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link.
7 CVE-2021-37351 276 2021-08-13 2021-08-23
5.0
None Remote Low Not required Partial None None
Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server.
8 CVE-2021-37350 89 Sql 2021-08-13 2021-08-23
7.5
None Remote Low Not required Partial Partial Partial
Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.
9 CVE-2021-37349 269 2021-08-13 2021-08-23
4.6
None Local Low Not required Partial Partial Partial
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database.
10 CVE-2021-37348 552 File Inclusion 2021-08-13 2021-08-23
5.0
None Remote Low Not required Partial None None
Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php.
11 CVE-2021-37347 269 2021-08-13 2021-08-23
4.6
None Local Low Not required Partial Partial Partial
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument.
12 CVE-2021-37346 78 Exec Code 2021-08-13 2021-08-24
7.5
None Remote Low Not required Partial Partial Partial
Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).
13 CVE-2021-37345 269 2021-08-13 2021-08-23
4.6
None Local Low Not required Partial Partial Partial
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.
14 CVE-2021-37344 78 Exec Code 2021-08-13 2021-08-24
7.5
None Remote Low Not required Partial Partial Partial
Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).
15 CVE-2021-37343 22 Dir. Trav. 2021-08-13 2021-08-23
6.5
None Remote Low ??? Partial Partial Partial
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.
16 CVE-2021-37223 918 2021-10-05 2021-10-12
4.0
None Remote Low ??? Partial None None
Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. Any authenticated user can create scheduled reports containing PDF screenshots of any view in the NagiosXI application. Due to lack of input sanitisation, the target page can be replaced with an SSRF payload to access internal resources or disclose local system files.
17 CVE-2021-36366 2021-09-28 2021-10-04
7.5
None Remote Low Not required Partial Partial Partial
Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.
18 CVE-2021-36365 276 2021-09-28 2021-10-01
7.5
None Remote Low Not required Partial Partial Partial
Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.
19 CVE-2021-36364 2021-09-28 2021-10-04
7.5
None Remote Low Not required Partial Partial Partial
Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.
20 CVE-2021-36363 276 2021-09-28 2021-10-01
7.5
None Remote Low Not required Partial Partial Partial
Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.
21 CVE-2021-33179 79 XSS 2021-10-14 2021-10-20
4.3
None Remote Medium Not required None Partial None
The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. An authenticated victim, who accesses a specially crafted malicious URL, would unknowingly execute the attached payload.
22 CVE-2021-33177 89 Sql 2021-10-14 2021-10-20
6.5
None Remote Low ??? Partial Partial Partial
The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. Exploitation requires the malicious actor to be authenticated to the vulnerable system, but once authenticated they would be able to execute arbitrary sql queries.
23 CVE-2021-28925 89 Sql 2021-04-08 2021-04-13
7.5
None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/.
24 CVE-2021-28924 79 XSS 2021-04-08 2021-04-12
4.3
None Remote Medium Not required None Partial None
Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.
25 CVE-2021-25299 79 Exec Code XSS 2021-02-15 2021-03-04
4.3
None Remote Medium Not required None Partial None
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.
26 CVE-2021-25298 78 2021-02-15 2021-03-04
9.0
None Remote Low ??? Complete Complete Complete
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
27 CVE-2021-25297 78 2021-02-15 2021-03-09
9.0
None Remote Low ??? Complete Complete Complete
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
28 CVE-2021-25296 78 2021-02-15 2021-03-04
9.0
None Remote Low ??? Complete Complete Complete
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.
29 CVE-2021-3277 434 Exec Code 2021-06-07 2021-06-15
6.5
None Remote Low ??? Partial Partial Partial
Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.
30 CVE-2021-3273 94 2021-02-25 2021-03-02
9.0
None Remote Low ??? Complete Complete Complete
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.
31 CVE-2021-3193 Exec Code 2021-01-26 2021-02-03
7.5
None Remote Low Not required Partial Partial Partial
Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.
32 CVE-2020-35578 78 Exec Code 2021-01-13 2021-04-26
9.0
None Remote Low ??? Complete Complete Complete
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.
33 CVE-2020-35269 352 CSRF 2020-12-23 2021-03-02
6.8
None Remote Medium Not required Partial Partial Partial
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers.
34 CVE-2020-28911 922 2021-05-24 2021-06-03
4.0
None Remote Low ??? Partial None None
Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command in ajaxhelper.php.
35 CVE-2020-28910 276 2021-05-24 2021-05-28
10.0
None Remote Low Not required Complete Complete Complete
Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getprofile.sh.
36 CVE-2020-28909 732 2021-05-24 2021-06-03
9.0
None Remote Low ??? Complete Complete Complete
Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo.
37 CVE-2020-28908 77 2021-05-24 2021-06-03
7.5
None Remote Low Not required Partial Partial Partial
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.
38 CVE-2020-28907 295 Exec Code 2021-05-24 2021-06-03
10.0
None Remote Low Not required Complete Complete Complete
Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh.
39 CVE-2020-28906 276 2021-05-24 2021-05-28
9.0
None Remote Low ??? Complete Complete Complete
Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root.
40 CVE-2020-28905 20 Exec Code 2021-05-24 2021-05-28
6.5
None Remote Low ??? Partial Partial Partial
Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.
41 CVE-2020-28904 269 Exec Code 2021-05-24 2021-05-28
7.5
None Remote Low Not required Partial Partial Partial
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code.
42 CVE-2020-28903 79 XSS 2021-05-24 2021-05-28
4.3
None Remote Medium Not required None Partial None
Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS.
43 CVE-2020-28902 77 2021-05-24 2021-05-28
10.0
None Remote Low Not required Complete Complete Complete
Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.
44 CVE-2020-28901 77 Exec Code 2021-05-24 2021-05-28
10.0
None Remote Low Not required Complete Complete Complete
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php.
45 CVE-2020-28900 345 Exec Code 2021-05-24 2021-05-28
10.0
None Remote Low Not required Complete Complete Complete
Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.
46 CVE-2020-28648 20 Exec Code 2020-11-16 2021-05-26
9.0
None Remote Low ??? Complete Complete Complete
Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.
47 CVE-2020-27991 79 XSS 2020-11-16 2020-11-17
3.5
None Remote Medium ??? None Partial None
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).
48 CVE-2020-27990 79 XSS 2020-11-16 2020-11-17
3.5
None Remote Medium ??? None Partial None
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
49 CVE-2020-27989 79 XSS 2020-11-16 2020-11-17
3.5
None Remote Medium ??? None Partial None
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
50 CVE-2020-27988 79 XSS 2020-11-16 2020-11-17
3.5
None Remote Medium ??? None Partial None
Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).
Total number of vulnerabilities : 148   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.