Vulnerabilities > Nagios > Critical

DATE CVE VULNERABILITY TITLE RISK
2023-12-14 CVE-2023-48084 SQL Injection vulnerability in Nagios XI
Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.
network
low complexity
nagios CWE-89
critical
9.8
2023-12-14 CVE-2023-48085 Unspecified vulnerability in Nagios XI
Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.
network
low complexity
nagios
critical
9.8
2021-05-24 CVE-2020-28900 Insufficient Verification of Data Authenticity vulnerability in Nagios Fusion and Nagios XI
Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to an untrusted update package to upgrade_to_latest.sh.
network
low complexity
nagios CWE-345
critical
10.0
2021-05-24 CVE-2020-28901 Command Injection vulnerability in Nagios Fusion
Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php.
network
low complexity
nagios CWE-77
critical
10.0
2021-05-24 CVE-2020-28902 Command Injection vulnerability in Nagios Fusion
Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.
network
low complexity
nagios CWE-77
critical
10.0
2021-05-24 CVE-2020-28906 Incorrect Default Permissions vulnerability in Nagios Fusion and Nagios XI
Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root.
network
low complexity
nagios CWE-276
critical
9.0
2021-05-24 CVE-2020-28907 Improper Certificate Validation vulnerability in Nagios Fusion
Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an untrusted update package in upgrade_to_latest.sh.
network
low complexity
nagios CWE-295
critical
10.0
2021-05-24 CVE-2020-28909 Incorrect Permission Assignment for Critical Resource vulnerability in Nagios Fusion
Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts.
network
low complexity
nagios CWE-732
critical
9.0
2021-05-24 CVE-2020-28910 Incorrect Permission Assignment for Critical Resource vulnerability in Nagios XI
Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getprofile.sh.
network
low complexity
nagios CWE-732
critical
10.0
2021-02-25 CVE-2021-3273 Code Injection vulnerability in Nagios XI
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component.
network
low complexity
nagios CWE-94
critical
9.0