Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 90

Export CSV
CVE-2024-14006

Nagios XI < 2024R1.2.2 Host Header Injection

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-14005

Nagios XI < 2024R1.2 Command Injection via Docker Wizard

Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wizard allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.

CVSS 4.0 · 9.4 Critical EPSS 4.0% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-14004

Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)

Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user could manipulate NagVis configuration data or leverage insufficiently validated configuration settings to obtain elevated privileges on the Nagios XI system.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-14003

Nagios XI < 2024R1.2 RCE via NRDP Server Plugins

Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of the web/Nagios service.

CVSS 4.0 · 9.4 Critical EPSS 2.3% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-14002

Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis

Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.

CVSS 4.0 · 7.1 High EPSS 1.7% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-14001

Nagios XI < 2024R1.1.3 XSS via Executive Summary Report

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-14000

Nagios XI < 2024R1.1.3 XSS via Capacity Planning Report

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-13998

Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts. CVE-2024-13995 addresses a similar vulnerability with a potentially incomplete fix for the underlying problem in earlier versions.

CVSS 4.0 · 6 Medium EPSS 1.0% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-13997

Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host

Nagios XI versions prior to 2024R1.1.3 contain a privilege escalation vulnerability in which an authenticated administrator could leverage the Migrate Server feature to obtain root privileges on the underlying XI host. By abusing the migration workflow, an admin-level attacker could execute actions outside the intended security scope of the application, resulting in full control of the operating system.

CVSS 4.0 · 9.4 Critical EPSS 1.2% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-13996

Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change

Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.

CVSS 4.0 · 9.2 Critical EPSS 1.1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-13995

Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts.

CVSS 4.0 · 7.1 High EPSS 1.3% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-13994

Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization

Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation, privilege escalation, or full compromise of the Nagios XI web interface depending on the target account.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-13993

Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers

Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2024-13992

Nagios XI < 2024R1.1 XSS via Missing Page / 404

Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website. The vulnerable component, page-missing.php, fails to properly validate or escape user-supplied input, allowing an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI domain.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2023-7318

Nagios XI < 2024R1.0.2 XSS via Core Command Expansion

Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2023-7317

Nagios XI < 2024R1 Web SSH Terminal Missing Access Control

Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of sensitive information.

CVSS 4.0 · 9.4 Critical EPSS 1.7% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2023-7316

Nagios XI < 2024R1 XSS via Graph Explorer

Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2023-7315

Nagios XI < 5.11.3 XSS via Graph Explorer

Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2023-7314

Nagios XI < 5.11.3 XSS via Bandwidth Report

Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi
CVE-2023-7313

Nagios XI < 5.11.3 XSS via Bulk Modifications

Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Nagios Xi Xi