Total
6 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-38350 | 1 Pnp4nagios | 1 Pnp4nagios | 2024-11-21 | N/A | 5.4 MEDIUM |
| PNP4Nagios through 81ebfc5 has stored XSS in the AJAX controller via the basket API and filters. This affects 0.6.26. | |||||
| CVE-2023-38349 | 1 Pnp4nagios | 1 Pnp4nagios | 2024-11-21 | N/A | 8.8 HIGH |
| PNP4Nagios through 81ebfc5 lacks CSRF protection in the AJAX controller. This affects 0.6.26. | |||||
| CVE-2017-16834 | 1 Pnp4nagios | 1 Pnp4nagios | 2024-11-21 | 7.2 HIGH | 7.8 HIGH |
| PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account but root code execution depends on these files, which allows local users to gain privileges by leveraging access to this unprivileged account. | |||||
| CVE-2014-4908 | 1 Pnp4nagios | 1 Pnp4nagios | 2024-11-21 | 4.3 MEDIUM | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching (1) share/pnp/application/views/kohana_error_page.php or (2) share/pnp/application/views/template.php, leading to improper handling within an http-equiv="refresh" META element. | |||||
| CVE-2014-4907 | 2 Op5, Pnp4nagios | 2 Monitor, Pnp4nagios | 2024-11-21 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in share/pnp/application/views/kohana_error_page.php in PNP4Nagios before 0.6.22 allows remote attackers to inject arbitrary web script or HTML via a parameter that is not properly handled in an error message. | |||||
| CVE-2012-3457 | 1 Pnp4nagios | 1 Pnp4nagios | 2024-11-21 | 2.1 LOW | N/A |
| PNP4Nagios 0.6 through 0.6.16 uses world-readable permissions for process_perfdata.cfg, which allows local users to obtain the Gearman shared secret by reading the file. | |||||