FU
Product
Fusion
19
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 5Medium 8Low 0
Watch
Add Fusion to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-28908 | 9.8 | May 24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios Affected: through 4.1.8 |
| CVE-2020-28907 | 9.8 | May 24 | Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via vectors related to download of an… Affected: through 4.1.8 |
| CVE-2020-28904 | 9.8 | May 24 | Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a malicious component containing PHP code Affected: through 4.1.8 |
| CVE-2020-28902 | 9.8 | May 24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php Affected: through 4.1.8 |
| CVE-2020-28901 | 9.8 | May 24 | Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in… Affected: through 4.1.8 |
| CVE-2020-28900 | 9.8 | May 24 | Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of Privileges or Code Execution as root via… Affected: through 4.1.8 |
| CVE-2020-28909 | 8.8 | May 24 | Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts Affected: through 4.1.8 |
| CVE-2020-28906 | 8.8 | May 24 | Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root Affected: through 4.1.8 |
| CVE-2020-28905 | 8.8 | May 24 | Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination Affected: through 4.1.8 |
| CVE-2025-60425 | 8.6 | Oct 27 | Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a… Affected: 2024; 2024 |
| CVE-2025-60424 | 7.6 | Oct 27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication via a bruteforce attack Affected: 2024; 2024 |
| CVE-2020-28911 | 6.5 | May 24 | Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fused servers via the test_server command… Affected: through 4.1.8 |
| CVE-2018-25119 | 6.1 | Oct 30 | Nagios Fusion versions prior to 4.1.5 are vulnerable to cross-site scripting (XSS) via the "fusionwindow" parameter Affected: before 4.1.5 |
| CVE-2017-20209 | 6.1 | Oct 30 | Nagios Fusion versions prior to 4.0.1 are vulnerable to cross-site scripting (XSS) via the Users and Servers pages Affected: 4.0.0 |
| CVE-2020-28903 | 6.1 | May 24 | Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS Affected: through 4.1.8 |
| CVE-2018-12501 | 6.1 | Jun 16 | Nagios Fusion before 4.1.4 has XSS, aka TPS#13332-13335 Affected: before 4.1.4 |
| CVE-2023-7312 | 4.8 | Oct 30 | Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings Affected: before 4.2.0 |
| CVE-2023-53690 | 4.8 | Oct 30 | Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be… Affected: before 4.2.0 |
| CVE-2023-53689 | 4.8 | Oct 30 | Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key configuration flow that can result in execution of… Affected: before 4.2.0 |
Showing 19