Vulnerabilities > Nagios > Nagios XI > 5.8.5
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-09-15 | CVE-2021-38156 | Cross-site Scripting vulnerability in Nagios XI In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. | 5.4 |
| 2021-08-13 | CVE-2021-37343 | Path Traversal vulnerability in Nagios XI A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios. | 8.8 |
| 2021-08-13 | CVE-2021-37345 | Improper Privilege Management vulnerability in Nagios XI Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions. | 7.8 |
| 2021-08-13 | CVE-2021-37347 | Path Traversal vulnerability in Nagios XI Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument. | 7.8 |
| 2021-08-13 | CVE-2021-37348 | Files or Directories Accessible to External Parties vulnerability in Nagios XI Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php. | 7.5 |
| 2021-08-13 | CVE-2021-37349 | Unspecified vulnerability in Nagios XI Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the database. | 7.8 |
| 2021-08-13 | CVE-2021-37350 | SQL Injection vulnerability in Nagios XI Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation. | 9.8 |
| 2021-08-13 | CVE-2021-37351 | Incorrect Default Permissions vulnerability in Nagios XI Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a crafted HTTP request to the server. | 5.3 |
| 2021-08-13 | CVE-2021-37352 | Open Redirect vulnerability in Nagios XI An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. | 6.1 |