Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
335 results · page 5 of 7
May 24, 2021Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to dowCVE-2020-28907 · Other software · Nagios · reported by MITRECritical 9.8
Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
May 24, 2021Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root.CVE-2020-28906 · Other software · Nagios · reported by MITREHigh 8.8
Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. Low-privileged users are able to modify files that are included (aka sourced) by scripts executed by root.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
May 24, 2021Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.CVE-2020-28905 · Other software · Nagios · reported by MITREHigh 8.8
Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
May 24, 2021Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component conCVE-2020-28904 · Other software · Nagios · reported by MITRECritical 9.8
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
May 24, 2021Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS.CVE-2020-28903 · Other software · Nagios · reported by MITREMedium 6.1
Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
May 24, 2021Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.CVE-2020-28902 · Other software · Nagios · reported by MITRECritical 9.8
Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
May 24, 2021Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installaCVE-2020-28901 · Other software · Nagios · reported by MITRECritical 9.8
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
May 24, 2021Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code ExCVE-2020-28900 · Other software · Nagios · reported by MITRECritical 9.8
Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.
- Product
- Fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
Apr 8, 2021SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/.CVE-2021-28925 · Other software · Nagios · reported by MITRECritical 9.8
SQL injection vulnerability in Nagios Network Analyzer before 2.4.3 via the o[col] parameter to api/checks/read/.
- Product
- Network Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2021Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.CVE-2021-28924 · Other software · Nagios · reported by MITREMedium 6.1
Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.
- Product
- Network Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2021Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component.CVE-2021-3273 · Other software · Nagios · reported by MITREHigh 7.2
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comnagios.com
Feb 15, 2021Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability.CVE-2020-24899 · Other software · Nagios · reported by MITREHigh 8.8
Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Feb 15, 2021NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability.CVE-2020-22427 · Other software · Nagios · reported by MITREHigh 7.2
NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted, and the only option is to pay for a subscription service where technical details may be disclosed at an unspecified later time
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Feb 15, 2021Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).CVE-2021-25299 · Other software · Nagios · reported by MITREMedium 6.1
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comassets.nagios.com
Feb 15, 2021Nagios XI OS Command InjectionCVE-2021-25298 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
- Product
- Nagios XI
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Feb 15, 2021Nagios XI OS Command InjectionCVE-2021-25297 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
- Product
- Nagios XI
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Feb 15, 2021Nagios XI OS Command InjectionCVE-2021-25296 · Other software · Nagios · reported by MITREExploitedHigh 8.8
Nagios XI contains a vulnerability which can lead to OS command injection on the Nagios XI server.
- Product
- Nagios XI
- On CISA’s list since
- Jan 18, 2022 (federal fix deadline Feb 1, 2022)
- What to do
- Attackers are using this now. Install Nagios’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Feb 3, 2021The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other useCVE-2021-26024 · Other software · Nagios · reported by MITREMedium 5.3
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorites for any other user account.
- Product
- Favorites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2021The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.CVE-2021-26023 · Other software · Nagios · reported by MITREMedium 6.1
The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.
- Product
- Favorites
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to CVE-2021-3193 · Other software · Nagios · reported by MITRECritical 9.8
Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthenticated attacker to execute remote code as the apache user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2021Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, wCVE-2020-25385 · Other software · Nagios · reported by MITREMedium 6.1
Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page.
- Product
- LOG Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2021An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0.CVE-2020-35578 · Other software · Nagios · reported by MITREHigh 7.2
An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Dec 23, 2020Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or serverCVE-2020-35269 · Other software · Nagios · reported by MITREHigh 8.8
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers.
- Product
- Nagios Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 16, 2020Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).CVE-2020-27991 · Other software · Nagios · reported by MITREMedium 5.4
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).CVE-2020-27990 · Other software · Nagios · reported by MITREMedium 5.4
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).CVE-2020-27989 · Other software · Nagios · reported by MITREMedium 5.4
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2020Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).CVE-2020-27988 · Other software · Nagios · reported by MITREMedium 5.4
Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2020Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.CVE-2020-28648 · Other software · Nagios · reported by MITREHigh 8.8
Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comskylightcyber.com
Nov 13, 2020Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-CVE-2020-5796 · Other software · Nagios · reported by vulnreport@tenable.comHigh 7.8
Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of files, resulting in low-privileged users being able to write to and execute arbitrary PHP code with root privileges.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Oct 20, 2020Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimatCVE-2020-5792 · Other software · Nagios · reported by vulnreport@tenable.comHigh 7.2
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comtenable.com
Oct 20, 2020Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commaCVE-2020-5791 · Other software · Nagios · reported by vulnreport@tenable.comHigh 7.2
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 20, 2020Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a craCVE-2020-5790 · Other software · Nagios · reported by vulnreport@tenable.comMedium 6.5
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Sep 9, 2020An issue was found in Nagios XI before 5.7.3.CVE-2020-15903 · Other software · Nagios · reported by MITRECritical 9.8
An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2020A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.CVE-2020-16157 · Other software · Nagios · reported by MITREMedium 5.4
A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.
- Product
- LOG Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgetastra.com
Jul 22, 2020Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.CVE-2020-15902 · Other software · Nagios · reported by MITREMedium 6.1
Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinsinuator.netnagios.com
Jul 22, 2020In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.CVE-2020-15901 · Other software · Nagios · reported by MITREHigh 8.8
In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinsinuator.netnagios.com
Jul 17, 2020HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.CVE-2020-7206 · Other software · HP · reported by security-alert@hpe.comCritical 9.8
HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.
- Product
- Nagios-plugins-hpilo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2020Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram anCVE-2020-13977 · Other software · Nagios · reported by MITREMedium 4.9
Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408.
- Product
- Nagios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2020Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.CVE-2020-10821 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Mar 22, 2020Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.CVE-2020-10820 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Mar 22, 2020Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.CVE-2020-10819 · Other software · Nagios · reported by MITREMedium 4.8
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Mar 16, 2020Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.CVE-2020-6582 · Other software · Nagios · reported by MITREHigh 7.5
Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.
- Product
- Remote Plug IN Executor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Mar 16, 2020Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sCVE-2020-6581 · Other software · Nagios · reported by MITREHigh 7.3
Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection.
- Product
- Remote Plug IN Executor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Mar 16, 2020Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page.CVE-2020-6586 · Other software · Nagios · reported by MITREMedium 5.4
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered.
- Product
- Nagios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.nagios.commedium.com
Mar 16, 2020Nagios Log Server 2.1.3 has CSRF.CVE-2020-6585 · Other software · Nagios · reported by MITREHigh 8.8
Nagios Log Server 2.1.3 has CSRF.
- Product
- Nagios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.nagios.commedium.com
Mar 16, 2020Nagios Log Server 2.1.3 has Incorrect Access Control.CVE-2020-6584 · Other software · Nagios · reported by MITREMedium 6.5
Nagios Log Server 2.1.3 has Incorrect Access Control.
- Product
- Nagios
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordassets.nagios.commedium.com
Feb 28, 2020UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; opeCVE-2019-3698 · Other software · SUSE · reported by meissner@suse.deMedium 5.7
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions.
- Product
- SUSE Linux Enterprise Server 12
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orglists.opensuse.org
Jan 20, 2020Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios usCVE-2019-20384 · Other software · Gentoo · reported by MITREMedium 5.5
Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners.
- Product
- Portage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.gentoo.org
Dec 31, 2019In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the coCVE-2019-20197 · Other software · Nagios · reported by MITREHigh 8.8
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Dec 30, 2019In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter.CVE-2019-20139 · Other software · Nagios · reported by MITREMedium 5.4
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.
- Product
- Nagios XI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.