deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50585
Published: 2025-10-30
Description: The Core Config Manager (CCM) in Nagios XI versions prior to CCM 3.1.7 / Nagios XI 5.8.9 contains a cross-site scripting (XSS) vulnerability via the Audit Log page search input. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-ccm-xss-via-audit-log-page-search-input
CVE: CVE-2022-50586
Published: 2025-10-30
Description: Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the BPI component via the info URL field. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-stored-xss-via-bpi-info-url
CVE: CVE-2022-50587
Published: 2025-10-30
Description: Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) via the Apply Configuration error text. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-stored-xss-via-command-names-in-apply-config-error-text
CVE: CVE-2022-50588
Published: 2025-10-30
Description: Nagios XI versions prior to 5.8.9 are vulnerable to cross-site scripting (XSS) in the update checking feature. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.vulncheck.com/advisories/nagios-xi-stored-xss-in-update-checking
CVE: CVE-2023-53688
Published: 2025-10-30
Description: Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component. An attacker can submit crafted input that is not properly validated or escaped, allowing injection of malicious script that executes in the context of a victim's browser (XSS). Additionally, the component does not enforce sufficient anti-CSRF protections on state-changing operations, enabling an attacker to induce authenticated users to perform unwanted actions.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-xss-and-csrf-via-hypermap-relay
CVE: CVE-2023-53689
Published: 2025-10-30
Description: Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting (XSS) vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly corrupted by the reflected XSS, the resulting browser compromise can lead to credential/session theft and unauthorized administrative actions.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-fusion/; https://www.nagios.com/products/security/#fusion; https://www.vulncheck.com/advisories/nagios-fusion-license-information-reflected-xss
CVE: CVE-2023-53690
Published: 2025-10-30
Description: Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability in the LDAP/AD authentication-server configuration. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add authentication servers via LDAP/AD integration could persist a malicious payload that executes in the context of other users' browsers.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-fusion/; https://www.nagios.com/products/security/#fusion; https://www.vulncheck.com/advisories/nagios-fusion-ldap-ad-integration-stored-xss
CVE: CVE-2023-7312
Published: 2025-10-30
Description: Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) vulnerability when adding or configuring Email Settings. Unsanitized user input can be stored and later rendered in the administrative UI, causing JavaScript to execute in the browser of any user who views the affected page. An attacker who can add or modify SMTP/email settings or manipulate the sendmail configuration fields could persist a malicious payload that executes in the context of other users' browsers.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-fusion/; https://www.nagios.com/products/security/#fusion; https://www.vulncheck.com/advisories/nagios-fusion-email-settings-stored-xss-via-smtp-sendmail
CVE: CVE-2023-7313
Published: 2025-10-30
Description: Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-xss-via-bulk-modification
CVE: CVE-2023-7314
Published: 2025-10-30
Description: Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Bandwidth Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-xss-via-bandwidth-report
CVE: CVE-2023-7315
Published: 2025-10-30
Description: Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-xss-via-graph-explorer
CVE: CVE-2023-7316
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Graph Explorer component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-xss-via-graph-explorer-2
CVE: CVE-2023-7317
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of sensitive information.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-web-ssh-terminal-missing-access-control
CVE: CVE-2023-7318
Published: 2025-10-30
Description: Nagios XI versions prior to < 2024R1.0.2 are vulnerable to cross-site scripting (XSS) via the Nagios Core Command Expansion page. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/2024r1-0-2/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-xss-via-core-command-expansion
CVE: CVE-2023-7319
Published: 2025-10-30
Description: Nagios Network Analyzer versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Percentile Calculator menu. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/#network-analyzer; https://www.vulncheck.com/advisories/nagios-network-analyzer-xss-via-percentile-calculator-menu
CVE: CVE-2023-7321
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2.1.14 are vulnerable to cross-site scripting (XSS) via the Snapshots Page. Untrusted log content was not safely encoded for the output context, allowing attacker-controlled data present in logs to execute script in the victim’s browser within the application origin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-log-server-2024r1/; https://www.vulncheck.com/advisories/nagios-log-server-xss-via-snapshots-page
CVE: CVE-2023-7322
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2024R1 contain an incorrect authorization vulnerability. Users who lacked the required API permission were nevertheless able to invoke API endpoints, resulting in unintended access to data and actions exposed via the API. This incorrect authorization check could allow authenticated but non-privileged users to read or modify resources beyond their intended rights.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://www.nagios.com/changelog/nagios-log-server-2024r1/; https://www.vulncheck.com/advisories/nagios-log-server-incorrect-authorization-granting-full-api-access
CVE: CVE-2023-7323
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2024R1 are vulnerable to cross-site scripting (XSS) via the Create User function. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-log-server-2024r1/; https://www.vulncheck.com/advisories/nagios-log-server-xss-via-create-user-function
CVE: CVE-2023-7325
Published: 2025-10-30
Description: Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrpc.sock handler. The product accepts specially crafted XML-RPC requests that can be used to instruct the server to connect to internal unix socket RPC endpoints and perform privileged XML-RPC methods. An attacker able to send such requests can invoke administrative RPC methods via the unix socket interface to create arbitrary user accounts on the system, resulting in account creation and potential takeover of the bastion host. VulnCheck has observed this vulnerability being exploited in the wild as of 2025-10-30 at 00:30:17.837319 UTC.
CWE: CWE-306, CWE-918
References: https://cn-sec.com/archives/1947658.html; https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/%E5%AE%89%E6%81%92/%E5%AE%89%E6%81%92%20%E6%98%8E%E5%BE%A1%E8%BF%90%E7%BB%B4%E5%AE%A1%E8%AE%A1%E4%B8%8E%E9%A3%8E%E9%99%A9%E6%8E%A7%E5%88%B6%E7%B3%BB%E7%BB%9F%20xmlrpc.sock%20%E4%BB%BB%E6%84%8F%E7%94%A8%E6%88%B7%E6%B7%BB%E5%8A%A0%E6%BC%8F%E6%B4%9E.md; https://www.vulncheck.com/advisories/mingyu-operations-and-maintenance-audit-and-risk-control-system-xmirpc-sock-ssrf
CVE: CVE-2024-13993
Published: 2025-10-30
Description: Nagios XI versions prior to < 2024R1.1.2 are vulnerable to a reflected cross-site scripting (XSS) via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when visited by a victim, executes arbitrary JavaScript in the victim’s browser within the Nagios XI origin. The issue is observable under legacy browser behaviors; modern browsers may mitigate some vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-reflected-xss-via-login-page-on-older-browsers
CVE: CVE-2024-13994
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control when the 'Allow Insecure Logins' option is enabled. Under this configuration, any user can create valid login credentials for other users without proper authorization. This can lead to unauthorized account creation, privilege escalation, or full compromise of the Nagios XI web interface depending on the target account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-allow-insecure-logins-missing-authorization
CVE: CVE-2024-13995
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have access to that data. Exposure of API keys or password hashes could lead to account compromise, abuse of API privileges, or offline cracking attempts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-497
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-api-keys-and-hashed-password-authenticated-information-disclosure
CVE: CVE-2024-13996
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user when that user's password was changed. As a result, any pre-existing sessions (including those potentially controlled by an attacker) remained valid after a credential update. This insufficient session expiration could allow continued unauthorized access to user data and actions even after a password change.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-session-not-invalidated-after-password-change
CVE: CVE-2024-13999
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromise of network-integrated systems.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-497
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-ad-ldap-token-authenticated-information-disclosure
CVE: CVE-2024-14000
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Capacity Planning Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-xss-via-capacity-planning-report
CVE: CVE-2024-14001
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-xss-via-executive-summary-report
CVE: CVE-2024-14002
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An authenticated user can supply crafted path values that cause the server to include local files, potentially exposing sensitive information from the underlying host.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-98
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-authenticated-local-file-inclusion-via-nagvis
CVE: CVE-2024-14003
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary commands on the underlying host in the context of the web/Nagios service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-rce-via-nrdp-server-plugins
CVE: CVE-2024-14004
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handling (nagvis.conf). An authenticated user could manipulate NagVis configuration data or leverage insufficiently validated configuration settings to obtain elevated privileges on the Nagios XI system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-nagvis-configuration
CVE: CVE-2024-14005
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient validation of user-supplied input in the wizard allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-command-injection-via-docker-wizard
CVE: CVE-2024-14006
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-346
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-host-header-injection
CVE: CVE-2024-14008
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizard. Insufficient validation of user-supplied input allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-rce-via-winrm-configuration-wizard
CVE: CVE-2024-14009
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The System Profile feature is an administrative diagnostic/configuration capability. Due to improper access controls and unsafe handling of exported/imported profile data and operations, an authenticated administrator could exploit this vulnerability to execute actions on the underlying XI host outside the application's security scope. Successful exploitation may allow an administrator to obtain root privileges on the XI server.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-privilege-escalation-via-system-profile
CVE: CVE-2024-58272
Published: 2025-10-30
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2023-7323.
CVE: CVE-2024-58273
Published: 2025-10-30
Description: Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacker who could execute commands as the Apache web user (or the backend shell user) to escalate to root on the host.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266
References: https://www.nagios.com/changelog/#log-server-2024R1; https://www.nagios.com/products/security/#log-server; https://www.vulncheck.com/advisories/nagios-log-server-lpe-from-apache-backend-shell-user-to-root
CVE: CVE-2025-34134
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence (BPI) component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters (notably bpi_logfile and bpi_configfile) allow an authenticated administrative user to cause the product to create or overwrite files within the webroot and subsequently edit them via the BPI configuration editor. When such files carry executable extensions and are served by the web application, arbitrary code may be executed in the context of the web application user. Successful exploitation results in arbitrary command execution with the privileges of the Nagios XI web application user and can be leveraged to gain further control of the underlying host operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-rce-via-business-process-intelligence-bpi
CVE: CVE-2025-34135
Published: 2025-10-30
Description: Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive. In particular, the nagios.service unit had executable permissions that were not required. Overly permissive permissions on service unit files can broaden local attack surface by enabling unintended execution behaviors or facilitating abuse of service operations when combined with other weaknesses.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-732
References: https://www.nagios.com/changelog/nagios-xi/; https://www.nagios.com/products/security/#nagios-xi; https://www.vulncheck.com/advisories/nagios-xi-overly-permissive-permissions-on-systemd-unit-files
CVE: CVE-2025-34249
Published: 2025-10-30
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60425.
CVE: CVE-2025-34269
Published: 2025-10-30
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as it is a duplicate of CVE-2025-60424.