Vulnerabilities > Nagios

DATE CVE VULNERABILITY TITLE RISK
2021-09-28 CVE-2021-36363 Incorrect Default Permissions vulnerability in Nagios XI
Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.
network
low complexity
nagios CWE-276
7.5
2021-09-28 CVE-2021-36364 Unspecified vulnerability in Nagios XI
Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.
network
low complexity
nagios
7.5
2021-09-28 CVE-2021-36365 Incorrect Default Permissions vulnerability in Nagios XI
Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.
network
low complexity
nagios CWE-276
7.5
2021-09-28 CVE-2021-36366 Unspecified vulnerability in Nagios XI
Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.
network
low complexity
nagios
7.5
2021-09-15 CVE-2021-38156 Cross-site Scripting vulnerability in Nagios XI
In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.
network
nagios CWE-79
3.5
2021-08-13 CVE-2021-37343 Path Traversal vulnerability in Nagios XI
A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.
network
low complexity
nagios CWE-22
6.5
2021-08-13 CVE-2021-37344 OS Command Injection vulnerability in Nagios XI Switch Wizard
Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).
network
low complexity
nagios CWE-78
7.5
2021-08-13 CVE-2021-37345 Improper Privilege Management vulnerability in Nagios XI
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for some scripts with elevated permissions.
local
low complexity
nagios CWE-269
4.6
2021-08-13 CVE-2021-37346 OS Command Injection vulnerability in Nagios XI Watchguard Wizard
Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).
network
low complexity
nagios CWE-78
7.5
2021-08-13 CVE-2021-37347 Path Traversal vulnerability in Nagios XI
Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it receives as an argument.
local
low complexity
nagios CWE-22
4.6