Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (203 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-28648 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.
CVE-2020-27991 1 Nagios 1 Nagios Xi 2024-11-21 5.4 Medium
Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).
CVE-2020-27990 1 Nagios 1 Nagios Xi 2024-11-21 5.4 Medium
Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
CVE-2020-27989 1 Nagios 1 Nagios Xi 2024-11-21 5.4 Medium
Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
CVE-2020-27988 1 Nagios 1 Nagios Xi 2024-11-21 5.4 Medium
Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).
CVE-2020-24899 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.
CVE-2020-23992 1 Nagios 1 Nagios Xi 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request.
CVE-2020-22427 1 Nagios 1 Nagios Xi 2024-11-21 7.2 High
NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted, and the only option is to pay for a subscription service where technical details may be disclosed at an unspecified later time
CVE-2020-15903 1 Nagios 1 Nagios Xi 2024-11-21 9.8 Critical
An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3.
CVE-2020-15902 1 Nagios 1 Nagios Xi 2024-11-21 6.1 Medium
Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
CVE-2020-15901 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
CVE-2020-10821 1 Nagios 1 Nagios Xi 2024-11-21 4.8 Medium
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.
CVE-2020-10820 1 Nagios 1 Nagios Xi 2024-11-21 4.8 Medium
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ password parameter.
CVE-2020-10819 1 Nagios 1 Nagios Xi 2024-11-21 4.8 Medium
Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.
CVE-2019-9167 1 Nagios 1 Nagios Xi 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in Nagios XI before 5.5.11 allows attackers to inject arbitrary web script or HTML via the xiwindow parameter.
CVE-2019-9166 1 Nagios 1 Nagios Xi 2024-11-21 7.8 High
Privilege escalation in Nagios XI before 5.5.11 allows local attackers to elevate privileges to root via write access to config.inc.php and import_xiconfig.php.
CVE-2019-9165 1 Nagios 1 Nagios Xi 2024-11-21 9.8 Critical
SQL injection vulnerability in Nagios XI before 5.5.11 allows attackers to execute arbitrary SQL commands via the API when using fusekeys and malicious user id.
CVE-2019-9164 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.
CVE-2019-20197 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account.
CVE-2019-20139 1 Nagios 1 Nagios Xi 2024-11-21 5.4 Medium
In Nagios XI 5.6.9, XSS exists via the nocscreenapi.php host, hostgroup, or servicegroup parameter, or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.