Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
206 results · page 4 of 5
Feb 15, 2021Nagios XI OS Command InjectionCVE-2021-25298 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
- Product
- Nagios XI
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Feb 15, 2021Nagios XI OS Command InjectionCVE-2021-25297 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
- Product
- Nagios XI
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Feb 15, 2021Nagios XI OS Command InjectionCVE-2021-25296 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
- Product
- Nagios XI
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Feb 3, 2021The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other useCVE-2021-26024 · Other software · Nagios · reported by MITREMedium 5.3
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account.
- Product
- Favorites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2021The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.CVE-2021-26023 · Other software · Nagios · reported by MITREMedium 6.1
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.
- Product
- Favorites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to CVE-2021-3193 · Other software · Nagios · reported by MITRECritical 9.8
Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2021An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.CVE-2020-35578 · Other software · Nagios · reported by MITREHigh 7.2
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Nov 16, 2020Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).CVE-2020-27991 · Other software · Nagios · reported by MITREMedium 5.4
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).CVE-2020-27990 · Other software · Nagios · reported by MITREMedium 5.4
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).CVE-2020-27989 · Other software · Nagios · reported by MITREMedium 5.4
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).CVE-2020-27988 · Other software · Nagios · reported by MITREMedium 5.4
Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2020Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.CVE-2020-28648 · Other software · Nagios · reported by MITREHigh 8.8
Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
Nov 13, 2020Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-CVE-2020-5796 · Other software · Nagios · reported by vulnreport@tenable.comHigh 7.8
Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users being able to write to and execute arbitrary PHP code with root privileges.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Oct 20, 2020Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimatCVE-2020-5792 · Other software · Nagios · reported by vulnreport@tenable.comHigh 7.2
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comtenable.com
Oct 20, 2020Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commaCVE-2020-5791 · Other software · Nagios · reported by vulnreport@tenable.comHigh 7.2
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 20, 2020Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a craCVE-2020-5790 · Other software · Nagios · reported by vulnreport@tenable.comMedium 6.5
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Sep 9, 2020An issue was found in Nagios XI before 5.7.3.CVE-2020-15903 · Other software · Nagios · reported by MITRECritical 9.8
An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2020Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.CVE-2020-15902 · Other software · Nagios · reported by MITREMedium 6.1
Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinsinuator.netnagios.com
Jul 22, 2020In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.CVE-2020-15901 · Other software · Nagios · reported by MITREHigh 8.8
In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinsinuator.netnagios.com
Mar 22, 2020Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.CVE-2020-10821 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Mar 22, 2020Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.CVE-2020-10820 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Mar 22, 2020Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.CVE-2020-10819 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Dec 31, 2019In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the coCVE-2019-20197 · Other software · Nagios · reported by MITREHigh 8.8
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Dec 30, 2019In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter.CVE-2019-20139 · Other software · Nagios · reported by MITREMedium 5.4
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Sep 5, 2019Nagios XI Remote Code Execution VulnerabilityCVE-2019-15949 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a remote code execution vulnerability in which a user can modify the check_plugin executable and insert malicious commands to execute as root.
- Product
- Nagios XI
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Jul 10, 2019Nagios XI before 5.5.4 has XSS in the auto login admin management page.CVE-2018-17147 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI before 5.5.4 has XSS in the auto login admin management page.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comassets.nagios.com
Jun 19, 2019An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before CVE-2018-17148 · Other software · Nagios · reported by MITRECritical 9.8
An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.nagios.comassets.nagios.com
Jun 19, 2019A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page.CVE-2018-17146 · Other software · Nagios · reported by MITREMedium 5.4
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.nagios.comassets.nagios.com
May 22, 2019Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form).CVE-2019-12279 · Other software · Nagios · reported by MITRECritical 9.8
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Mar 28, 2019Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter.CVE-2019-9167 · Other software · Nagios · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnagios.com
Mar 28, 2019Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php.CVE-2019-9166 · Other software · Nagios · reported by MITREHigh 7.8
Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnagios.com
Mar 28, 2019SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands.CVE-2019-9204 · Other software · Nagios · reported by MITRECritical 9.8
SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands.
- Product
- Incident Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnagios.com
Mar 28, 2019Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API.CVE-2019-9203 · Other software · Nagios · reported by MITRECritical 9.8
Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API.
- Product
- Incident Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnagios.com
Mar 28, 2019Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.CVE-2019-9202 · Other software · Nagios · reported by MITREHigh 8.8
Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.
- Product
- Incident Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnagios.com
Mar 28, 2019SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id.CVE-2019-9165 · Other software · Nagios · reported by MITRECritical 9.8
SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comnagios.com
Mar 28, 2019Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.CVE-2019-9164 · Other software · Nagios · reported by MITREHigh 8.8
Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Dec 17, 2018An issue was discovered in Nagios XI before 5.5.8.CVE-2018-20172 · Other software · Nagios · reported by MITREMedium 6.1
An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2018An issue was discovered in Nagios XI before 5.5.8.CVE-2018-20171 · Other software · Nagios · reported by MITREMedium 6.1
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2018Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.CVE-2018-15714 · Other software · Nagios · reported by vulnreport@tenable.comMedium 6.1
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the oname and oname2 parameters.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 14, 2018Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.CVE-2018-15713 · Other software · Nagios · reported by vulnreport@tenable.comMedium 5.4
Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 14, 2018Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php.CVE-2018-15712 · Other software · Nagios · reported by vulnreport@tenable.comMedium 6.1
Nagios XI 5.5.6 allows reflected cross site scripting from remote unauthenticated attackers via the host parameter in api_tool.php.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 14, 2018Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users.CVE-2018-15711 · Other software · Nagios · reported by vulnreport@tenable.comHigh 8.8
Nagios XI 5.5.6 allows remote authenticated attackers to reset and regenerate the API key of more privileged users. The attacker can then use the new API key to execute API calls at elevated privileges.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 14, 2018Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.CVE-2018-15710 · Other software · Nagios · reported by vulnreport@tenable.comHigh 7.8
Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Nov 14, 2018Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.CVE-2018-15709 · Other software · Nagios · reported by vulnreport@tenable.comHigh 8.8
Nagios XI 5.5.6 allows remote authenticated attackers to execute arbitrary commands via a crafted HTTP request.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Nov 14, 2018Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.CVE-2018-15708 · Other software · Nagios · reported by vulnreport@tenable.comCritical 9.8
Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
May 16, 2018A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.CVE-2018-10738 · Other software · Nagios · reported by MITREHigh 7.2
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2018A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.CVE-2018-10737 · Other software · Nagios · reported by MITREHigh 7.2
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2018A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.CVE-2018-10736 · Other software · Nagios · reported by MITREHigh 7.2
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2018A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.CVE-2018-10735 · Other software · Nagios · reported by MITREHigh 7.2
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2018An issue was discovered in Nagios XI 5.4.13.CVE-2018-10554 · Other software · Nagios · reported by MITREMedium 5.4
An issue was discovered in Nagios XI 5.4.13. There is XSS exploitable via CSRF in (1) the Schedule New Report screen via the hour, minute, or ampm parameter, related to components/scheduledreporting; (2) includes/components/xicore/downtime.php, related to the update_pages function; (3) the ajaxhelper.php opts or background parameter; (4) the i[] array parameter to ajax_handler.php; or (5) the deploynotification.php title parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.