Nagios Nagios Xi 2024

SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php component.

An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component.

Nagios XI < 2024R1.2 RCE via NRDP Server Plugins

Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure

Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change

Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization

Nagios XI < 2024R1.2 Command Injection via Docker Wizard

Nagios XI < 2024R2 Authenticated Command Injection via WinRM Plugin

Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard

Nagios XI < 2024R1.4.2 RCE via Business Process Intelligence (BPI)

Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host

Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile

Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE

An issue with the Autodiscover component in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted Dashlet.

Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)

Nagios XI < 2024R1.2.2 Host Header Injection

Nagios XI < 2024R2 Privilege Escalation via process_perfdata.pl

Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis

Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes

Nagios XI 2024R1.2.2 has an Information Disclosure vulnerability, which allows unauthenticated users to access multiple pages displaying the usernames and email addresses of all current users.

A SQL Injection vulnerability in Nagios XI 2024R1.2.2 allows a remote attacker to execute SQL injection via a crafted payload in the History Tab component.

Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure

Nagios XI 2024R1.2.2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack through the Favorites component, enabling POST-based Cross-Site Scripting (XSS).

Nagios XI 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability in the Tools page. This flaw allows an attacker to inject malicious scripts into the Tools interface, which are then stored and executed in the context of other users accessing the page.

A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's session via a specially crafted URL. The issue resides in a web component responsible for rendering performance-related data.

Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers

Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an attacker to craft a malicious link that redirects users to an arbitrary external URL without their consent.

A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged users to execute malicious HTML or JavaScript code via the audio file upload functionality from the Operation Center section. This allows any authenticated user to execute arbitrary JavaScript code on behalf of other users, including the administrators.

A cross-site scripting (XSS) vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page.

Nagios XI < 2024R1.1.3 XSS via Executive Summary Report

Nagios XI < 2024R1.1.3 XSS via Capacity Planning Report

Nagios XI < 2024R1.1 XSS via Missing Page / 404

Nagios XI < 2024R1.0.2 XSS via Core Command Expansion

Nagios XI < 2024R1.4.2 Overly Permissive Permissions on Systemd Unit Files