NA
Product
Nagios
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 5Medium 6Low 0
Watch
Add Nagios to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-0726 | 9.8 | Jun 6 | The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for remote attackers to obtain access by… Affected: All versions, or not specified |
| CVE-2014-5009 | 9.8 | Mar 31 | Snoopy allows remote attackers to execute arbitrary commands Affected: through 4.2.3 |
| CVE-2008-7313 | 9.8 | Mar 31 | The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands Affected: through 4.2.3 |
| CVE-2016-9565 | 9.8 | Dec 15 | MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the… Affected: through 4.2.1 |
| CVE-2020-6585 | 8.8 | Mar 16 | Nagios Log Server 2.1.3 has CSRF Affected: 2.1.3 |
| CVE-2016-8641 | 7.8 | Aug 1 | A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3 |
| CVE-2016-10089 | 7.8 | Feb 15 | Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641 Affected: through 4.2.4 |
| CVE-2016-9566 | 7.8 | Dec 15 | base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file Affected: through 4.2.3 |
| CVE-2019-3698 | 7.0 | Feb 28 | UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory… Affected: before 3.5.1; before 3.0.6 |
| CVE-2020-6584 | 6.5 | Mar 16 | Nagios Log Server 2.1.3 has Incorrect Access Control Affected: 2.1.3 |
| CVE-2017-12847 | 6.3 | Aug 23 | Nagios Core before 4.3.3 creates a nagios.lock PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging… Affected: through 4.3.2 |
| CVE-2016-6209 | 6.1 | Mar 31 | Cross-site scripting (XSS) vulnerability in Nagios Affected: All versions, or not specified |
| CVE-2018-13441 | 5.5 | Jul 12 | qh_help in Nagios Core version 4.4.1 and earlier is prone to a NULL pointer dereference vulnerability, which allows attacker to cause a local denial-of-service condition by… Affected: through 4.4.1 |
| CVE-2020-6586 | 5.4 | Mar 16 | Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page Affected: 2.1.3 |
| CVE-2020-13977 | 4.9 | Jun 9 | Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via… Affected: 4.4.5 |
| CVE-2014-4703 | – | Dec 5 | lib/parse_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag Affected: 2.0.2 |
| CVE-2014-4702 | – | Dec 5 | The check_icmp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a different… Affected: through 2.0.1 |
| CVE-2014-4701 | – | Dec 5 | The check_dhcp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a different… Affected: through 2.0.1 |
| CVE-2014-1878 | – | Feb 28 | Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before… Affected: through 4.0.3; 4.0.0; 4.0.0; 4.0.0; 4.0.0; 4.0.2 |
| CVE-2013-2214 | – | Feb 10 | status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote… Affected: 3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +33 more |
| CVE-2013-7205 | – | Jan 15 | Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information… Affected: through 4.0.2; 3.0; 3.0; 3.0; 3.0; 3.0; +30 more |
| CVE-2013-7108 | – | Jan 15 | Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain… Affected: through 4.0.2; 3.0; 3.0; 3.0; 3.0; 3.0; +30 more |
| CVE-2013-4214 | – | Nov 23 | rss-newsfeed.php in Nagios Core 3.4.4, 3.5.1, and earlier, when MAGPIE_CACHE_ON is set to 1, allows local users to overwrite arbitrary files via a symlink attack on… Affected: through 3.5.1; 3.4.4 |
| CVE-2012-6096 | – | Jan 22 | Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before… Affected: through 3.4.3; 3.0; 3.0; 3.0; 3.0; 3.0; +28 more |
| CVE-2011-2179 | – | Jun 14 | Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script… Affected: 3.2.3 |
| CVE-2011-1523 | – | May 3 | Cross-site scripting (XSS) vulnerability in statusmap.c in statusmap.cgi in Nagios 3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the layer… Affected: through 3.2.3; 1.0; 1.0_b1; 1.0_b2; 1.0_b3; 1.0b1; +34 more |
| CVE-2009-2288 | – | Jul 1 | statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters Affected: through 3.1.0; 1.0; 1.0b1; 1.0b2; 1.0b4; 1.1; +26 more |
| CVE-2008-6373 | – | Mar 2 | Unspecified vulnerability in Nagios before 3.0.6 has unspecified impact and remote attack vectors related to CGI programs, "adaptive external commands," and "writing newlines and… Affected: through 3.0.5; 1.0; 1.0_b1; 1.0_b2; 1.0_b3; 1.0b1; +34 more |
| CVE-2008-5028 | – | Nov 10 | Cross-site request forgery (CSRF) vulnerability in cmd.cgi in (1) Nagios 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote attackers to send commands to the Nagios process, and… Affected: through 3.0.4; 1.0; 1.0_b1; 1.0_b2; 1.0_b3; 1.0b1; +34 more |
| CVE-2008-5027 | – | Nov 10 | The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary… Affected: through 3.0.4; 1.0; 1.0_b1; 1.0_b2; 1.0_b3; 1.0b1; +34 more |
| CVE-2008-4796 | – | Oct 30 | The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost,… Affected: before 4.2.2 |
| CVE-2007-5803 | – | May 13 | Multiple cross-site scripting (XSS) vulnerabilities in CGI programs in Nagios before 2.12 might allow remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 1.0b1; 1.0b2; 1.0b3; 1.0b4; 1.0b5; 1.0b6; +25 more |
| CVE-2008-1360 | – | Mar 17 | Cross-site scripting (XSS) vulnerability in Nagios before 2.11 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts, a… Affected: 2.2; 2.3; 2.3.1; 2.7; 2.8; 2.9; +1 more |
| CVE-2007-5624 | – | Oct 23 | Cross-site scripting (XSS) vulnerability in Nagios 2.x before 2.10 allows remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts Affected: through 2.9 |
| CVE-2006-2489 | – | May 19 | Integer overflow in CGI scripts in Nagios 1.x before 1.4.1 and 2.x before 2.3.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code… Affected: 1.0; 1.0b1; 1.0b2; 1.0b3; 1.0b4; 1.0b5; +17 more |
| CVE-2006-2162 | – | May 3 | Buffer overflow in CGI scripts in Nagios 1.x before 1.4 and 2.x before 2.3 allows remote attackers to execute arbitrary code via a negative content length (Content-Length) HTTP… Affected: through 1.3; through 2.2 |
| CVE-2002-1959 | – | Dec 31 | Nagios 1.0b1 through 1.0b3 allows remote attackers to execute arbitrary commands via shell metacharacters in plugin output Affected: 1.0_b1; 1.0_b2; 1.0_b3 |
Showing 37