Nagios Log Server

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475.

Nagios Log Server < 2024R1.3.1 RCE via Malformed Dashboard ID

Nagios Log Server < 2024R2.0.3 Logstash Process Root Privileges

Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext

Nagios Log Server < 2024R1.3.2 Set Email Privilege Escalation

Nagios Log Server < 2024R1 Incorrect Authorization Granting Full API Access

Nagios Log Server < 2026R1.0.1 Authenticated Command Injection via Natural Language Queries

Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response. This is GL:NLS#474.

Nagios Log Server < 2026R1.0.1 Local Privilege Escalation via Writable Scripts and Sudo Rules

Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root

Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.

Nagios Log Server < 2024R2.0.3 Non-Admin Dashboard Deletion

Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated

Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard Fallback

Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page.

Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.

Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.

A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.

Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page.

Nagios Log Server < 1.4.2 Dashboards Logs Table XSS

Nagios Log Server < 2024R1 XSS via Create User Function

Nagios Log Server < 2.1.14 XSS via Snapshots Page

Nagios Log Server < 2.1.6 XSS via Create User, Edit User, & Manage Host Lists Pages