Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 318

Export CSV
CVE-2025-34280

Nagios Network Analyzer < 2024R2.0.1 RCE in LDAP Certificate Removal Function

Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management functionality whereby the certificate removal operation fails to apply adequate input sanitation. An authenticated administrator can trigger command execution on the underlying host in the context of the web application service, resulting in remote code execution with the service's privileges.

CVSS 4.0 · 8.6 High EPSS 1.4% KEV · Not listed
Vendors
Nagios
Products
Network Analyzer
CVE-2025-34278

Nagios Network Analyzer < 2024R1 Source Groups / Percentile Calculator Menu Stored XSS

Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source Groups page (percentile calculator menu). An attacker can supply a malicious payload which is stored by the application and later rendered in the context of other users. When a victim views the affected page the injected script executes in the victim's browser context.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Network Analyzer
CVE-2025-34277

Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID

Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID values are not properly validated before being forwarded to an internal API. An attacker able to supply crafted dashboard ID values can cause the system to execute attacker-controlled data, leading to arbitrary code execution in the context of the Log Server process.

CVSS 4.0 · 9.4 Critical EPSS 2.2% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2025-34274

Nagios Log Server < 2024R2.0.3 Logstash Process Root Privileges

Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs its embedded Logstash process as the root user. If an attacker is able to compromise the Logstash process - for example by exploiting an insecure plugin, pipeline configuration injection, or a vulnerability in input parsing - the attacker could execute code with root privileges, resulting in full system compromise. The Logstash service has been altered to run as the lower-privileged 'nagios' user to reduce this risk associated with a network-facing service that can accept untrusted input or load third-party components.

CVSS 4.0 · 9.3 Critical EPSS 2.1% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2025-34273

Nagios Log Server < 2024R2.0.3 Non-Admin Dashboard Deletion

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administrator users to delete global dashboards. The application did not correctly enforce authorization checks for the global dashboard deletion workflow, enabling lower-privileged users to remove dashboards that affect other users or the overall monitoring UI.

CVSS 4.0 · 7.1 High EPSS 1.0% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2025-34272

Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard Fallback

In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the application does not reliably fall back to an empty, default dashboard. In some implementations this can result in an unexpected dashboard being presented as the user's default view. Depending on the product's dashboard sharing and access policies, this behavior may cause information exposure or unexpected privilege exposure.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2025-34271

Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network path can intercept credentials in transit. Captured credentials could allow the attacker to authenticate as a cluster node or service account, enabling further unauthorized access, lateral movement, or system compromise.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2025-34270

Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field during import. As a result, the plaintext password supplied for imported accounts may be exposed in the user interface, logs, or other diagnostic output. This can leak sensitive credentials to administrators or anyone with access to import results.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2024-58273

Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root

Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user (or the backend shell user) to escalate to root on the host.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2023-7323

Nagios Log Server < 2024R1 XSS via Create User Function

Nagios Log Server versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Create User function. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2023-7322

Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access

Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights.

CVSS 4.0 · 8.7 High EPSS 1.1% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2023-7321

Nagios Log Server < 2.1.14 XSS via Snapshots Page

Nagios Log Server versions prior to 2.1.14 are vulnerable to cross-site scripting (XSS) via the Snapshots Page. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2023-7319

Nagios Network Analyzer < 2024R1 XSS via Percentile Calculator Menu

Nagios Network Analyzer versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Percentile Calculator menu. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Network Analyzer
CVE-2023-7312

Nagios Fusion < 4.2.0 Email Settings Stored XSS via SMTP/sendmail

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers.

CVSS 4.0 · 6.2 Medium EPSS 1.0% KEV · Not listed
Vendors
Nagios
Products
Fusion
CVE-2023-53690

Nagios Fusion < 4.2.0 LDAP/AD Integration Stored XSS

Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add authentication servers via LDAP/AD integration could persist a malicious payload that executes in the context of other users' browsers.

CVSS 4.0 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Fusion
CVE-2023-53689

Nagios Fusion < 4.2.0 License Information Reflected XSS

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly corrupted by the reflected XSS, the resulting browser compromise can lead to credential/session theft and unauthorized administrative actions.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Fusion
CVE-2020-36858

Nagios Log Server < 2.1.6 XSS via Create User, Edit User, & Manage Host Lists Pages

Nagios Log Server versions prior to 2.1.6 contain cross-site scripting (XSS) vulnerabilities via the web interface on the Create User, Edit User, and Manage Host Lists pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Log Server
CVE-2018-25119

Nagios Fusion < 4.1.5 XSS via fusionwindow Parameter

Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Fusion
CVE-2017-20209

Nagios Fusion < 4.0.1 XSS via Users/Servers Page

Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Fusion
CVE-2016-15049

Nagios Log Server < 1.4.2 Dashboards Logs Table XSS

Nagios Log Server versions prior to 1.4.2 are vulnerable to cross-site scripting (XSS) in the Dashboards section when rendering log entries in the Logs table. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nagios
Products
Log Server