Vulnerabilities > Nagios

DATE CVE VULNERABILITY TITLE RISK
2021-06-07 CVE-2021-3277 Unrestricted Upload of File With Dangerous Type vulnerability in Nagios XI
Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.
network
low complexity
nagios CWE-434
6.5
2021-05-24 CVE-2020-28900 Insufficient Verification of Data Authenticity vulnerability in Nagios Fusion and Nagios XI
Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.
network
low complexity
nagios CWE-345
critical
10.0
2021-05-24 CVE-2020-28901 Command Injection vulnerability in Nagios Fusion
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php.
network
low complexity
nagios CWE-77
critical
10.0
2021-05-24 CVE-2020-28902 Command Injection vulnerability in Nagios Fusion
Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.
network
low complexity
nagios CWE-77
critical
10.0
2021-05-24 CVE-2020-28903 Cross-Site Scripting vulnerability in Nagios Fusion
Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS.
network
nagios CWE-79
4.3
2021-05-24 CVE-2020-28904 Improper Privilege Management vulnerability in Nagios Fusion
Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code.
network
low complexity
nagios CWE-269
7.5
2021-05-24 CVE-2020-28905 Improper Input Validation vulnerability in Nagios Fusion
Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.
network
low complexity
nagios CWE-20
6.5
2021-05-24 CVE-2020-28906 Incorrect Default Permissions vulnerability in Nagios Fusion and Nagios XI
Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root.
network
low complexity
nagios CWE-276
critical
9.0
2021-05-24 CVE-2020-28907 Improper Certificate Validation vulnerability in Nagios Fusion
Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh.
network
low complexity
nagios CWE-295
critical
10.0
2021-05-24 CVE-2020-28908 Command Injection vulnerability in Nagios Fusion
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.
network
low complexity
nagios CWE-77
7.5