← Back

Nagios

nagios

301 CVEs • 18 products

Products (18)

Click to collapse
Toggle
Nagios Xi
nagios_xi
192 CVEs
Nagios
nagios
37 CVEs
Log Server
log_server
23 CVEs
Fusion
fusion
19 CVEs
Network Analyzer
network_analyzer
7 CVEs
Nagios Core
nagios_core
5 CVEs
Plugins
plugins
3 CVEs
Remote Plug In Executor
remote_plug_in_executor
3 CVEs
Incident Manager
incident_manager
3 CVEs
Favorites
favorites
2 CVEs
Nagios Cross Platform Agent
nagios_cross_platform_agent
2 CVEs
Remote Plugin Executor
remote_plugin_executor
1 CVE
Business Process Intelligence
business_process_intelligence
1 CVE
Nagios Xi Switch Wizard
nagios_xi_switch_wizard
1 CVE
Nagios Xi Watchguard Wizard
nagios_xi_watchguard_wizard
1 CVE
Nagios Xi Docker Wizard
nagios_xi_docker_wizard
1 CVE
Ndoutils
ndoutils
1 CVE
Nagios Network Analyzer
nagios_network_analyzer
1 CVE

CVEs (301)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-6585
1Nagios
1Nagios
Nov 21, 2024
Mar 16, 2020
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Nagios Log Server 2.1.3 has CSRF.
CVE-2020-6584
1Nagios
1Nagios
Nov 21, 2024
Mar 16, 2020
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
Nagios Log Server 2.1.3 has Incorrect Access Control.
CVE-2019-3698
2Nagios
Opensuse
3Backports Sle
LeapNagios
Nov 21, 2024
Feb 28, 2020
N/A· v4
7.0 HIGH· v3
6.9 MEDIUM· v2
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or p...Show more
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions.Show less
CVE-2019-20197
1Nagios
1Nagios Xi
Nov 21, 2024
Dec 31, 2019
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
CVE-2019-20139
1Nagios
1Nagios Xi
Nov 21, 2024
Dec 30, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.
CVE-2019-15949
1Nagios
1Nagios Xi
Nov 6, 2025
Sep 5, 2019
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downlo...Show more
Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.Show less
CVE-2019-15898
1Nagios
1Log Server
Nov 21, 2024
Sep 3, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.
CVE-2018-17147
1Nagios
1Nagios Xi
Nov 21, 2024
Jul 10, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Nagios XI before 5.5.4 has XSS in the auto login admin management page.
CVE-2018-17148
1Nagios
1Nagios Xi
Nov 21, 2024
Jun 19, 2019
N/A· v4
9.8 CRITICAL· v3
5.0 MEDIUM· v2
An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuratio...Show more
An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configuration snapshot page) in Nagios XI before 5.5.4 allows remote attackers to gain access to configuration files containing confidential credentials.Show less
CVE-2018-17146
1Nagios
1Nagios Xi
Nov 21, 2024
Jun 19, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript co...Show more
A cross-site scripting vulnerability exists in Nagios XI before 5.5.4 via the 'name' parameter within the Account Information page. Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the auto login admin management page.Show less
CVE-2019-12279
1Nagios
1Nagios Xi
Nov 21, 2024
May 22, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to...Show more
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luckShow less
CVE-2019-9167
1Nagios
1Nagios Xi
Nov 21, 2024
Mar 28, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter.
CVE-2019-9166
1Nagios
1Nagios Xi
Nov 21, 2024
Mar 28, 2019
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php.
CVE-2019-9204
1Nagios
1Incident Manager
Nov 21, 2024
Mar 28, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in Nagios IM (component of Nagios XI) before 2.2.7 allows attackers to execute arbitrary SQL commands.
CVE-2019-9203
1Nagios
1Incident Manager
Nov 21, 2024
Mar 28, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Authorization bypass in Nagios IM (component of Nagios XI) before 2.2.7 allows closing incidents in IM via the API.
CVE-2019-9202
1Nagios
1Incident Manager
Nov 21, 2024
Mar 28, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.
CVE-2019-9165
1Nagios
1Nagios Xi
Nov 21, 2024
Mar 28, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id.
CVE-2019-9164
1Nagios
1Nagios Xi
Nov 21, 2024
Mar 28, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.
CVE-2018-20172
1Nagios
1Nagios Xi
Nov 21, 2024
Dec 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Nagios XI before 5.5.8. The rss_url parameter of rss_dashlet/magpierss/scripts/magpie_slashbox.php is not filtered, resulting in an XSS vulnerability.
CVE-2018-20171
1Nagios
1Nagios Xi
Nov 21, 2024
Dec 17, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An issue was discovered in Nagios XI before 5.5.8. The url parameter of rss_dashlet/magpierss/scripts/magpie_simple.php is not filtered, resulting in an XSS vulnerability.