Vulnerabilities > Opsview > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-01-02 | CVE-2013-3935 | Cross-Site Request Forgery (CSRF) vulnerability in Opsview and Opsview Core Cross-site request forgery (CSRF) vulnerability in Opsview before 4.4.1 and Opsview Core before 20130522 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors. | 8.8 |
| 2018-09-05 | CVE-2018-16146 | OS Command Injection vulnerability in Opsview 5.4.0/5.4.1 The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. | 7.2 |
| 2018-09-05 | CVE-2018-16145 | Incorrect Permission Assignment for Critical Resource vulnerability in Opsview The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 invokes a file that can be edited by the nagios user, and would allow attackers to elevate their privileges to root after a system restart, hence obtaining full control of the appliance. | 8.1 |
| 2017-05-03 | CVE-2016-10367 | Path Traversal vulnerability in Opsview In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch), an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding bypass, %252f instead of /. | 7.5 |