Advisories · Technology
Nagios XI.
Every CVE that names Nagios XI among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 3.5 Low
An issue was discovered in Nagios XI before 5.9.3.
- Nagios XI
- CWE-208
- CVSS 3.1 Low
Open redirect in Nagios XI
- Nagios XI
- Open redirect
- CVSS 5.1 Medium
Nagios XI < 5.8.7 XSS in Core UI Views URL handling
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host
- Nagios XI
- Privilege escalation
- CVSS 6.0 Medium
Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure
- Nagios XI
- Information disclosure
- CVSS 5.1 Medium
Nagios XI < 2024R1.1 XSS via Missing Page / 404
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.8.0 XSS via Views URL Handling
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.4.13 XSS via Views Page
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2012R2.6 XSS via Tools Menu
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2011R1.9 XSS via Status/Report Page Link Functions
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.2.4 XSS via Report startdate/enddate Fields
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2011R1.9 XSS via Recurring Downtime Script
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.8.0 XSS via My Tools Page
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.2.4 XSS via “My Reports” Listing
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.2.4 XSS via Menu System
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.7.3 XSS via Manage Users in Admin Interface
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2024R1 XSS via Graph Explorer
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.11.3 XSS via Graph Explorer
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2024R1.1.3 XSS via Executive Summary Report
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.7.2 XSS via Dashboard Background Color Setting
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2024R1.0.2 XSS via Core Command Expansion
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2024R1.1.3 XSS via Capacity Planning Report
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.11.3 XSS via Bulk Modifications
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.7.2 XSS via BPI Config Management
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.8.0 XSS via BPI Config ID Handling
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.11.3 XSS via Bandwidth Report
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2011R1.9 XSS via backend_url JavaScript Link Handler
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2011R1.9 XSS via Alert Heatmap Report & “My Reports” Listing
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.8.7 XSS in Audit Log via Send to NLS Form
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.11.3 XSS & CSRF via Hypermap Replay
- Nagios XI
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- CVSS 9.4 CriticalCritical · CVSS 9+
Nagios XI < 2024R1 Web SSH Terminal Missing Access Control
- Nagios XI
- Broken access control
- CVSS 8.7 High
Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory
- Nagios XI
- Unrestricted file upload
- CVSS 6.9 Medium
Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via Highcharts
- Nagios XI
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
Nagios XI < 5.8.9 Stored XSS via Command Names in Apply Config Error Text
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.8.9 Stored XSS via BPI Info URL
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.8.9 Stored XSS in Update Checking
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 8.7 High
Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page
- Nagios XI
- SQL injection
- CVSS 8.7 High
Nagios XI < 5.2.4 SQL Injection in Notification Search
- Nagios XI
- SQL injection
- CVSS 9.2 CriticalCritical · CVSS 9+
Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change
- Nagios XI
- Authentication bypass
- CVSS 5.1 Medium
Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 2012R1.6 Reflected XSS via Dashlet AJAX Load Functionality
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard
- Nagios XI
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Nagios XI < 2026R1 RCE via Run Check Command in CCM
- Nagios XI
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Nagios XI < 2024R1.2 RCE via NRDP Server Plugins
- Nagios XI
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)
- Nagios XI
- Command injection
- CVSS 7.3 High
Nagios XI < 2011R1.9 Race Conditions in Crontab Install Scripts LPE
- Nagios XI
- Race condition
- CVSS 9.4 CriticalCritical · CVSS 9+
Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile
- Nagios XI
- Privilege escalation
- CVSS 8.7 High
Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)
- Nagios XI
- Privilege escalation
- CVSS 8.5 High
Nagios XI < 5.5.7 Privilege Escalation via MRTG Graphing Component
- Nagios XI
- Privilege escalation
- CVSS 8.5 High
Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script
- Nagios XI
- Path traversal
- Privilege escalation
- CVSS 8.4 High
Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl
- Nagios XI
- Broken access control
- CVSS 5.1 Medium
Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files
- Nagios XI
- Broken access control
- CVSS 8.5 High
Nagios XI < 5.8.7 Insecure Permissions on Highcharts Temporary Directory
- Nagios XI
- Privilege escalation
- CVSS 8.8 High
Nagios XI < 2024R1.2.2 Host Header Injection
- Nagios XI
- CWE-346
- CVSS 8.7 High
Nagios XI < 5.4.13 Component Download Page RCE
- Nagios XI
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Nagios XI < 2024R1.2 Command Injection via Docker Wizard
- Nagios XI
- Command injection
- CVSS 8.7 High
Nagios XI < 5.7.3 Command Injection in Report PDF Download
- Nagios XI
- Command injection
- CVSS 5.1 Medium
Nagios XI < 5.8.0 Core Config Manager (CCM) XSS via Templates Pages
- Nagios XI
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nagios XI < 5.8.2 Core Config Manager (CCM) XSS via Services Page
- Nagios XI
- Cross-site scripting (XSS)