10 results · Feed
-
Medium 6.9
Livestatus Injection in dynmaps
User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.
-
Medium 5.1
XSS via WYSIWYG editor
Improper neutralization of input in Nagvis before version 1.9.47 which can lead to XSS
-
Medium 5.3
Livestatus Injection in dynmaps
Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection
-
Medium 5.4
Checkmk NagVis Reflected Cross-site Scripting
The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious link that will execute arbitrary JavaScript in the context of the browser once clicked. The attack can be performed on both authenticated …
-
High 7.2
Checkmk NagVis Remote Code Execution
The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP.
-
High 8.8
Fix various XSS issues and potential RCE
Improper neutralization of input in Nagvis before version 1.9.42 which can lead to XSS
-
Unscored —
XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.
-
Critical 9.1CVE-2022-46945 Public exploit
Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/Nag…
-
Medium 5.6
NagVis CoreLogonMultisite.php checkAuthCookie type conversion
A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/classes/CoreLogonMultisite.php. The manipulation of the argument hash leads to incorrect type convers…
-
Unscored —
The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path trav…