Vulnerabilities > Nagios

DATE CVE VULNERABILITY TITLE RISK
2014-12-05 CVE-2014-4702 Information Exposure vulnerability in Nagios 2.0.1
The check_icmp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a different vulnerability than CVE-2014-4701.
local
low complexity
nagios CWE-200
2.1
2014-12-05 CVE-2014-4701 Information Exposure vulnerability in Nagios 2.0.1
The check_dhcp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a different vulnerability than CVE-2014-4702.
local
low complexity
nagios CWE-200
2.1
2014-05-05 CVE-2013-4215 Link Following vulnerability in Nagios Plugins 1.4.16
The IPXPING_COMMAND in contrib/check_ipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/ipxping/ipxping.
local
nagios CWE-59
4.4
2014-02-28 CVE-2014-1878 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.
network
low complexity
icinga nagios CWE-119
5.0
2014-01-15 CVE-2013-7205 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Nagios
Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.
network
low complexity
nagios CWE-119
6.4
2014-01-15 CVE-2013-7108 Improper Input Validation vulnerability in multiple products
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.
network
low complexity
nagios icinga CWE-20
5.5
2013-11-26 CVE-2013-6875 SQL Injection vulnerability in Nagios XI
SQL injection vulnerability in functions/prepend_adm.php in Nagios Core Config Manager in Nagios XI before 2012R2.4 allows remote attackers to execute arbitrary SQL commands via the tfPassword parameter to nagiosql/index.php.
network
low complexity
nagios CWE-89
7.5
2013-07-09 CVE-2013-1362 Improper Input Validation vulnerability in multiple products
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.
network
low complexity
opensuse nagios CWE-20
7.5
2013-01-22 CVE-2012-6096 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host parameter) or (2) svc_description variable.
network
low complexity
nagios icinga CWE-119
7.5
2011-06-14 CVE-2011-2179 Cross-Site Scripting vulnerability in multiple products
Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an (a) command action or a (b) hosts action.
network
icinga nagios CWE-79
4.3