Vulnerabilites related to pnp4nagios - pnp4nagios
Vulnerability from fkie_nvd
Published
2012-08-12 00:55
Modified
2024-11-21 01:40
Severity ?
Summary
PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| pnp4nagios | pnp4nagios | 0.6.0 | |
| pnp4nagios | pnp4nagios | 0.6.1 | |
| pnp4nagios | pnp4nagios | 0.6.2 | |
| pnp4nagios | pnp4nagios | 0.6.3 | |
| pnp4nagios | pnp4nagios | 0.6.4 | |
| pnp4nagios | pnp4nagios | 0.6.5 | |
| pnp4nagios | pnp4nagios | 0.6.6 | |
| pnp4nagios | pnp4nagios | 0.6.7 | |
| pnp4nagios | pnp4nagios | 0.6.10 | |
| pnp4nagios | pnp4nagios | 0.6.11 | |
| pnp4nagios | pnp4nagios | 0.6.12 | |
| pnp4nagios | pnp4nagios | 0.6.13 | |
| pnp4nagios | pnp4nagios | 0.6.14 | |
| pnp4nagios | pnp4nagios | 0.6.15 | |
| pnp4nagios | pnp4nagios | 0.6.16 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FD6A23D8-523A-4954-A93F-6D4D3FA8F1C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1BA83CAF-0BC7-456E-ACE0-3DAEA46432DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D6A6EA17-402B-4A98-BD7D-97E8F9D4A45D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2AB7A928-17CA-49DD-98F8-9CD3B3A9711C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4F6F00-CD12-48FC-AB40-1B6658F56FEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1AD65E85-E76B-43ED-BAC4-76BE852DC8A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "083B12F0-6BD9-41B3-891F-A065C653F280",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AC5FAE37-3D3C-4E4C-8D24-FEAFBB250641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "5696B4F3-E44A-43E3-A24C-53D85C36CC58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "38C497FF-5494-4177-B266-E83A27304E7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "070CAFD5-1694-4113-83F7-0C47ACD76918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "9FD4787A-A1CA-47C9-9E90-B2D26CA45A15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "3A4BA737-71F2-4115-AD16-A2AE64ADEB13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "D2A7B2E7-28AC-4E92-875C-DFE61B3F29D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.16:*:*:*:*:*:*:*",
"matchCriteriaId": "FA031C5B-4BFA-4DC1-8EEE-E5C3E42A356F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file."
},
{
"lang": "es",
"value": "PNP4Nagios de v0.6 hasta v0.6.16 utiliza permisos de lectura para process_perfdata.cfg, el cual podr\u00eda permitir a usuarios locales obtener la clave compartida Gearman mediante la lectura del fichero."
}
],
"id": "CVE-2012-3457",
"lastModified": "2024-11-21T01:40:54.987",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-08-12T00:55:00.810",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683879"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086161.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086387.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/08/06/7"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2012/08/06/8"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/54863"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683879"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086161.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086387.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/08/06/7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2012/08/06/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/54863"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-07-15 02:15
Modified
2024-11-21 08:13
Severity ?
Summary
PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/pnp4nagios/pnp4nagios/pull/17 | Issue Tracking | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/pnp4nagios/pnp4nagios/pull/17 | Issue Tracking |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| pnp4nagios | pnp4nagios | 0.6.26 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.26:*:*:*:*:*:*:*",
"matchCriteriaId": "FDE5ACEE-3F74-4CCF-AA4A-A72D19E7B5E3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26."
}
],
"id": "CVE-2023-38349",
"lastModified": "2024-11-21T08:13:23.380",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-07-15T02:15:08.857",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking"
],
"url": "https://github.com/pnp4nagios/pnp4nagios/pull/17"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://github.com/pnp4nagios/pnp4nagios/pull/17"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-11-16 02:29
Modified
2024-11-21 03:17
Severity ?
Summary
PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/lingej/pnp4nagios/issues/140 | Issue Tracking, Patch, Third Party Advisory | |
| cve@mitre.org | https://security.gentoo.org/glsa/201806-09 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/lingej/pnp4nagios/issues/140 | Issue Tracking, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://security.gentoo.org/glsa/201806-09 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| pnp4nagios | pnp4nagios | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6D8D29FE-3B5E-431E-926A-CE7F6215C566",
"versionEndIncluding": "0.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account."
},
{
"lang": "es",
"value": "En PNP4Nagios hasta la versi\u00f3n 0.6.26, /usr/bin/npcd y npcd.cfg son propiedad de una cuenta sin privilegios, pero la ejecuci\u00f3n de c\u00f3digo root depende de estos archivos. Esto permite que usuarios locales obtengan privilegios aprovechando el acceso a esta cuenta sin privilegios."
}
],
"id": "CVE-2017-16834",
"lastModified": "2024-11-21T03:17:03.633",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-11-16T02:29:05.410",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/lingej/pnp4nagios/issues/140"
},
{
"source": "cve@mitre.org",
"url": "https://security.gentoo.org/glsa/201806-09"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/lingej/pnp4nagios/issues/140"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.gentoo.org/glsa/201806-09"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-07-11 11:08
Modified
2024-11-21 02:11
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| op5 | monitor | 6.3.0 | |
| pnp4nagios | pnp4nagios | * | |
| pnp4nagios | pnp4nagios | 0.6.0 | |
| pnp4nagios | pnp4nagios | 0.6.1 | |
| pnp4nagios | pnp4nagios | 0.6.2 | |
| pnp4nagios | pnp4nagios | 0.6.3 | |
| pnp4nagios | pnp4nagios | 0.6.4 | |
| pnp4nagios | pnp4nagios | 0.6.5 | |
| pnp4nagios | pnp4nagios | 0.6.6 | |
| pnp4nagios | pnp4nagios | 0.6.7 | |
| pnp4nagios | pnp4nagios | 0.6.10 | |
| pnp4nagios | pnp4nagios | 0.6.11 | |
| pnp4nagios | pnp4nagios | 0.6.12 | |
| pnp4nagios | pnp4nagios | 0.6.13 | |
| pnp4nagios | pnp4nagios | 0.6.14 | |
| pnp4nagios | pnp4nagios | 0.6.15 | |
| pnp4nagios | pnp4nagios | 0.6.16 | |
| pnp4nagios | pnp4nagios | 0.6.17 | |
| pnp4nagios | pnp4nagios | 0.6.18 | |
| pnp4nagios | pnp4nagios | 0.6.19 | |
| pnp4nagios | pnp4nagios | 0.6.20 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:op5:monitor:6.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6EB86E63-02B5-4B8E-BF95-49FEB4B5998D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B8B7237D-1D86-46C5-BEFB-A2DC8D9BEE56",
"versionEndIncluding": "0.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FD6A23D8-523A-4954-A93F-6D4D3FA8F1C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1BA83CAF-0BC7-456E-ACE0-3DAEA46432DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D6A6EA17-402B-4A98-BD7D-97E8F9D4A45D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2AB7A928-17CA-49DD-98F8-9CD3B3A9711C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4F6F00-CD12-48FC-AB40-1B6658F56FEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1AD65E85-E76B-43ED-BAC4-76BE852DC8A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "083B12F0-6BD9-41B3-891F-A065C653F280",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AC5FAE37-3D3C-4E4C-8D24-FEAFBB250641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "5696B4F3-E44A-43E3-A24C-53D85C36CC58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "38C497FF-5494-4177-B266-E83A27304E7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "070CAFD5-1694-4113-83F7-0C47ACD76918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "9FD4787A-A1CA-47C9-9E90-B2D26CA45A15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "3A4BA737-71F2-4115-AD16-A2AE64ADEB13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "D2A7B2E7-28AC-4E92-875C-DFE61B3F29D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.16:*:*:*:*:*:*:*",
"matchCriteriaId": "FA031C5B-4BFA-4DC1-8EEE-E5C3E42A356F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.17:*:*:*:*:*:*:*",
"matchCriteriaId": "9A5B598F-CD97-4E30-A677-5393CF5196F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.18:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC6EB20-A966-4A6F-8776-0032DBED669D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.19:*:*:*:*:*:*:*",
"matchCriteriaId": "A5116144-9290-497A-8021-F0D9BA89A572",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.20:*:*:*:*:*:*:*",
"matchCriteriaId": "20E7828E-CFE6-4165-9330-482E8192E8A0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message."
},
{
"lang": "es",
"value": "Vulnerabildad de XSS en share/pnp/application/views/kohana_error_page.php en PNP4Nagios anterior a 0.6.22 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un par\u00e1metro que no se maneja debidamente en un mensaje de error."
}
],
"id": "CVE-2014-4907",
"lastModified": "2024-11-21T02:11:05.947",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-07-11T11:08:22.760",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://docs.pnp4nagios.org/pnp-0.6/dwnld"
},
{
"source": "cve@mitre.org",
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/59535"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/59603"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notes"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/68350"
},
{
"source": "cve@mitre.org",
"url": "https://bugs.op5.com/view.php?id=8761"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://docs.pnp4nagios.org/pnp-0.6/dwnld"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/59535"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/59603"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notes"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68350"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.op5.com/view.php?id=8761"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-07-15 02:15
Modified
2024-11-21 08:13
Severity ?
Summary
PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| pnp4nagios | pnp4nagios | 0.6.26 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.26:*:*:*:*:*:*:*",
"matchCriteriaId": "FDE5ACEE-3F74-4CCF-AA4A-A72D19E7B5E3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26."
}
],
"id": "CVE-2023-38350",
"lastModified": "2024-11-21T08:13:23.530",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-07-15T02:15:08.900",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/pnp4nagios/pnp4nagios/pull/16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/pnp4nagios/pnp4nagios/pull/16"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-07-11 11:08
Modified
2024-11-21 02:11
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| pnp4nagios | pnp4nagios | * | |
| pnp4nagios | pnp4nagios | 0.6.0 | |
| pnp4nagios | pnp4nagios | 0.6.1 | |
| pnp4nagios | pnp4nagios | 0.6.2 | |
| pnp4nagios | pnp4nagios | 0.6.3 | |
| pnp4nagios | pnp4nagios | 0.6.4 | |
| pnp4nagios | pnp4nagios | 0.6.5 | |
| pnp4nagios | pnp4nagios | 0.6.6 | |
| pnp4nagios | pnp4nagios | 0.6.7 | |
| pnp4nagios | pnp4nagios | 0.6.10 | |
| pnp4nagios | pnp4nagios | 0.6.11 | |
| pnp4nagios | pnp4nagios | 0.6.12 | |
| pnp4nagios | pnp4nagios | 0.6.13 | |
| pnp4nagios | pnp4nagios | 0.6.14 | |
| pnp4nagios | pnp4nagios | 0.6.15 | |
| pnp4nagios | pnp4nagios | 0.6.16 | |
| pnp4nagios | pnp4nagios | 0.6.17 | |
| pnp4nagios | pnp4nagios | 0.6.18 | |
| pnp4nagios | pnp4nagios | 0.6.19 | |
| pnp4nagios | pnp4nagios | 0.6.20 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B8B7237D-1D86-46C5-BEFB-A2DC8D9BEE56",
"versionEndIncluding": "0.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FD6A23D8-523A-4954-A93F-6D4D3FA8F1C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1BA83CAF-0BC7-456E-ACE0-3DAEA46432DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D6A6EA17-402B-4A98-BD7D-97E8F9D4A45D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2AB7A928-17CA-49DD-98F8-9CD3B3A9711C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9E4F6F00-CD12-48FC-AB40-1B6658F56FEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1AD65E85-E76B-43ED-BAC4-76BE852DC8A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "083B12F0-6BD9-41B3-891F-A065C653F280",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "AC5FAE37-3D3C-4E4C-8D24-FEAFBB250641",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "5696B4F3-E44A-43E3-A24C-53D85C36CC58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "38C497FF-5494-4177-B266-E83A27304E7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "070CAFD5-1694-4113-83F7-0C47ACD76918",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "9FD4787A-A1CA-47C9-9E90-B2D26CA45A15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "3A4BA737-71F2-4115-AD16-A2AE64ADEB13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "D2A7B2E7-28AC-4E92-875C-DFE61B3F29D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.16:*:*:*:*:*:*:*",
"matchCriteriaId": "FA031C5B-4BFA-4DC1-8EEE-E5C3E42A356F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.17:*:*:*:*:*:*:*",
"matchCriteriaId": "9A5B598F-CD97-4E30-A677-5393CF5196F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.18:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC6EB20-A966-4A6F-8776-0032DBED669D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.19:*:*:*:*:*:*:*",
"matchCriteriaId": "A5116144-9290-497A-8021-F0D9BA89A572",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pnp4nagios:pnp4nagios:0.6.20:*:*:*:*:*:*:*",
"matchCriteriaId": "20E7828E-CFE6-4165-9330-482E8192E8A0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv=\"refresh\" META element."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en PNP4Nagios hasta 0.6.22 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de la URI que se utiliza para alcanzar (1) share/pnp/application/views/kohana_error_page.php o (2) share/pnp/application/views/template.php, que conduce a un manejo indebido dentro de un elemento http-equiv=\u0027refresh\u0027 META."
}
],
"id": "CVE-2014-4908",
"lastModified": "2024-11-21T02:11:06.090",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-07-11T11:08:22.823",
"references": [
{
"source": "cve@mitre.org",
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/58973"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/68352"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bb"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/58973"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/68352"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2017-16834
Vulnerability from cvelistv5
Published
2017-11-16 02:00
Modified
2024-08-05 20:35
Severity ?
EPSS score ?
Summary
PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account.
References
| ▼ | URL | Tags |
|---|---|---|
| https://security.gentoo.org/glsa/201806-09 | vendor-advisory, x_refsource_GENTOO | |
| https://github.com/lingej/pnp4nagios/issues/140 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:35:21.009Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201806-09",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201806-09"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/lingej/pnp4nagios/issues/140"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-11-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-21T09:57:02",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "GLSA-201806-09",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201806-09"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/lingej/pnp4nagios/issues/140"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-16834",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201806-09",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201806-09"
},
{
"name": "https://github.com/lingej/pnp4nagios/issues/140",
"refsource": "MISC",
"url": "https://github.com/lingej/pnp4nagios/issues/140"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-16834",
"datePublished": "2017-11-16T02:00:00",
"dateReserved": "2017-11-15T00:00:00",
"dateUpdated": "2024-08-05T20:35:21.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-38349
Vulnerability from cvelistv5
Published
2023-07-15 00:00
Modified
2024-10-30 15:35
Severity ?
EPSS score ?
Summary
PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:39:12.920Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/pnp4nagios/pnp4nagios/pull/17"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T15:35:45.592881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-30T15:35:56.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-15T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/pnp4nagios/pnp4nagios/pull/17"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-38349",
"datePublished": "2023-07-15T00:00:00",
"dateReserved": "2023-07-15T00:00:00",
"dateUpdated": "2024-10-30T15:35:56.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-38350
Vulnerability from cvelistv5
Published
2023-07-15 00:00
Modified
2024-10-30 15:34
Severity ?
EPSS score ?
Summary
PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:39:12.814Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/pnp4nagios/pnp4nagios/pull/16"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-38350",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T15:33:58.909779Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-30T15:34:16.589Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-15T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/pnp4nagios/pnp4nagios/pull/16"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-38350",
"datePublished": "2023-07-15T00:00:00",
"dateReserved": "2023-07-15T00:00:00",
"dateUpdated": "2024-10-30T15:34:16.589Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-4908
Vulnerability from cvelistv5
Published
2014-07-11 10:00
Modified
2024-08-06 11:27
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bb | x_refsource_CONFIRM | |
| http://secunia.com/advisories/58973 | third-party-advisory, x_refsource_SECUNIA | |
| https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014 | x_refsource_CONFIRM | |
| http://openwall.com/lists/oss-security/2014/07/11/3 | mailing-list, x_refsource_MLIST | |
| http://www.securityfocus.com/bid/68352 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:27:37.030Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bb"
},
{
"name": "58973",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/58973"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014"
},
{
"name": "[oss-security] 20140711 Re: CVE request: XSS in PNP4Nagios",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"name": "68352",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68352"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-06-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv=\"refresh\" META element."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-07-11T09:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bb"
},
{
"name": "58973",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/58973"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014"
},
{
"name": "[oss-security] 20140711 Re: CVE request: XSS in PNP4Nagios",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"name": "68352",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68352"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4908",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv=\"refresh\" META element."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bb",
"refsource": "CONFIRM",
"url": "https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bb"
},
{
"name": "58973",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/58973"
},
{
"name": "https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014",
"refsource": "CONFIRM",
"url": "https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014"
},
{
"name": "[oss-security] 20140711 Re: CVE request: XSS in PNP4Nagios",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"name": "68352",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68352"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4908",
"datePublished": "2014-07-11T10:00:00",
"dateReserved": "2014-07-11T00:00:00",
"dateUpdated": "2024-08-06T11:27:37.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-3457
Vulnerability from cvelistv5
Published
2012-08-12 00:00
Modified
2024-08-06 20:05
Severity ?
EPSS score ?
Summary
PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683879 | x_refsource_MISC | |
| http://www.securityfocus.com/bid/54863 | vdb-entry, x_refsource_BID | |
| http://www.openwall.com/lists/oss-security/2012/08/06/8 | mailing-list, x_refsource_MLIST | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086387.html | vendor-advisory, x_refsource_FEDORA | |
| http://www.openwall.com/lists/oss-security/2012/08/06/7 | mailing-list, x_refsource_MLIST | |
| http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086161.html | vendor-advisory, x_refsource_FEDORA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:05:12.520Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683879"
},
{
"name": "54863",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/54863"
},
{
"name": "[oss-security] 20120806 Re: CVE ASSIGN: pnp4nagios: process_perfdata.cfg world readable",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/06/8"
},
{
"name": "FEDORA-2012-13215",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086387.html"
},
{
"name": "[oss-security] 20120806 CVE ASSIGN: pnp4nagios: process_perfdata.cfg world readable",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/06/7"
},
{
"name": "FEDORA-2012-13244",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086161.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-04-05T09:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683879"
},
{
"name": "54863",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/54863"
},
{
"name": "[oss-security] 20120806 Re: CVE ASSIGN: pnp4nagios: process_perfdata.cfg world readable",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/06/8"
},
{
"name": "FEDORA-2012-13215",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086387.html"
},
{
"name": "[oss-security] 20120806 CVE ASSIGN: pnp4nagios: process_perfdata.cfg world readable",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2012/08/06/7"
},
{
"name": "FEDORA-2012-13244",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-September/086161.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-3457",
"datePublished": "2012-08-12T00:00:00",
"dateReserved": "2012-06-14T00:00:00",
"dateUpdated": "2024-08-06T20:05:12.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-4907
Vulnerability from cvelistv5
Published
2014-07-11 10:00
Modified
2024-08-06 11:27
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/59535 | third-party-advisory, x_refsource_SECUNIA | |
| http://secunia.com/advisories/59603 | third-party-advisory, x_refsource_SECUNIA | |
| https://bugs.op5.com/view.php?id=8761 | x_refsource_CONFIRM | |
| http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9 | x_refsource_CONFIRM | |
| http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notes | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/68350 | vdb-entry, x_refsource_BID | |
| http://openwall.com/lists/oss-security/2014/07/11/3 | mailing-list, x_refsource_MLIST | |
| http://docs.pnp4nagios.org/pnp-0.6/dwnld | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T11:27:37.062Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "59535",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59535"
},
{
"name": "59603",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59603"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.op5.com/view.php?id=8761"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notes"
},
{
"name": "68350",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68350"
},
{
"name": "[oss-security] 20140711 Re: CVE request: XSS in PNP4Nagios",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://docs.pnp4nagios.org/pnp-0.6/dwnld"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-06-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-07-14T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "59535",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59535"
},
{
"name": "59603",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59603"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.op5.com/view.php?id=8761"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notes"
},
{
"name": "68350",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/68350"
},
{
"name": "[oss-security] 20140711 Re: CVE request: XSS in PNP4Nagios",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://docs.pnp4nagios.org/pnp-0.6/dwnld"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-4907",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "59535",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59535"
},
{
"name": "59603",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59603"
},
{
"name": "https://bugs.op5.com/view.php?id=8761",
"refsource": "CONFIRM",
"url": "https://bugs.op5.com/view.php?id=8761"
},
{
"name": "http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9"
},
{
"name": "http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notes",
"refsource": "CONFIRM",
"url": "http://www.op5.com/blog/news/op5-monitor-6-3-1-release-notes"
},
{
"name": "68350",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/68350"
},
{
"name": "[oss-security] 20140711 Re: CVE request: XSS in PNP4Nagios",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2014/07/11/3"
},
{
"name": "http://docs.pnp4nagios.org/pnp-0.6/dwnld",
"refsource": "CONFIRM",
"url": "http://docs.pnp4nagios.org/pnp-0.6/dwnld"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-4907",
"datePublished": "2014-07-11T10:00:00",
"dateReserved": "2014-07-11T00:00:00",
"dateUpdated": "2024-08-06T11:27:37.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}