These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2023-24035 is a vulnerability in Nagios XI before version 5.9.3, where an insecure timing comparison in the is_insecure_login_authenticated function allows an attacker to brute-force the admin password by measuring timing differences in the comparison. This issue impacts Nagios XI installations, potentially allowing attackers to measure timing differences to brute-force the admin password. Defenders s [truncated]
An open redirect vulnerability was discovered in twilio_ajax_handler.php in Nagios XI before 5.9.3, allowing an attacker to force a user to visit a malicious site. This vulnerability can be used to facilitate phishing or other malicious activities. Defenders should assess exposure and verify the version in use. The CVE record and NVD entry provide limited information about the vulnerability, and further v [truncated]
CVE-2021-25298 affects Nagios XI and is identified by CISA as a known exploited vulnerability. The official guidance in the supplied corpus is to apply updates per vendor instructions, making this a high-priority defensive item for any environment running Nagios XI.
CVE-2021-25297 is a Nagios XI OS command injection vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2022-01-18. Because it is listed in KEV, organizations should treat remediation as urgent and follow vendor update guidance without delay.
CVE-2021-25296 is an OS command injection vulnerability in Nagios XI. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-01-18, which means defenders should treat it as actively exploited risk and prioritize remediation. The source corpus indicates the required action is to apply updates per vendor instructions, with a CISA due date of 2022-02-01.
CVE-2019-15949 is a Nagios XI remote code execution vulnerability that CISA has listed in the Known Exploited Vulnerabilities catalog. Because it is marked as known exploited, defenders should treat unpatched Nagios XI deployments as a high-priority remediation item and apply vendor updates as soon as possible.
CVE-2016-10089 describes a local privilege-escalation weakness in Nagios where a local user can gain root privileges by abusing a hard link attack against the Nagios init script file. NVD rates the issue High (CVSS 7.8) and classifies it as requiring local access with low privileges, but no user interaction. The vulnerability was publicly disclosed in the CVE record on 2017-02-15, with advisory references [truncated]