📦

nagios

Vendor: nagios

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 9 Code Available
Total RCEs 6 Remote Access
Total CVEs 179 Total Indexed
Avg. EPSS 10.14% Exploit Prob.
Latest CVE CVE-2020-13977 Jun 09

Security Vulnerability Index

Page 2 / 18
9.8 CVSS
CVE-2014-5009
RCE

Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008.

EPSS: 4.71%
9.8 CVSS
CVE-2008-7313
RCE

The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.

EPSS: 4.54%
7.8 CVSS
CVE-2016-10089

Nagios 4.3.2 and earlier allows local users to gain root privileges via a hard link attack on the Nagios init script file, related to CVE-2016-8641.

EPSS: 0.52%
7.8 CVSS
CVE-2016-9566
Exploit Found

base/logging.c in Nagios Core before 4.2.4 allows local users with access to an account in the nagios group to gain root privileges via a symlink attack on the log file. NOTE: this can be leveraged by remote attackers using CVE-2016-9565.

EPSS: 4.88%
9.8 CVSS
CVE-2016-9565
Exploit Found

MagpieRSS, as used in the front-end component in Nagios Core before 4.2.2 might allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server. NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4796.

EPSS: 22.68%
2.1 CVSS
CVE-2014-4703
Exploit Found

lib/parse_ini.c in Nagios Plugins 2.0.2 allows local users to obtain sensitive information via a symlink attack on the configuration file in the extra-opts flag. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4701.

EPSS: 1.08%
2.1 CVSS
CVE-2014-4702

The check_icmp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a different vulnerability than CVE-2014-4701.

EPSS: 0.41%
2.1 CVSS
CVE-2014-4701

The check_dhcp plugin in Nagios Plugins before 2.0.2 allows local users to obtain sensitive information from INI configuration files via the extra-opts flag, a different vulnerability than CVE-2014-4702.

EPSS: 0.54%
5.0 CVSS
CVE-2014-1878

Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.

EPSS: 3.13%
4.0 CVSS
CVE-2013-2214

status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup (1) overview, (2) summary, or (3) grid style in status.cgi. NOTE: this behavior is by design in most 3.x versions, but the upstream vendor "decided to change it for Nagios 4" and 3.5.1.

EPSS: 4.34%