Xymon
Sign in to watchby Xymon
CVEs (7)
| CVE | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-2056 | Hig | 0.65 | 8.8 | 0.56 | Apr 13, 2016 | xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c. | |
| CVE-2015-1430 | Cri | 0.64 | 9.8 | 0.00 | Aug 28, 2017 | Buffer overflow in xymon 4.3.17-1. | |
| CVE-2016-2055 | Hig | 0.57 | 7.5 | 0.68 | Apr 13, 2016 | xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the configuration directory via a "config" command. | |
| CVE-2016-2058 | Med | 0.35 | 5.4 | 0.00 | Apr 13, 2016 | Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to inject arbitrary web script or HTML via a status-message, which is not properly handled in the "detailed status" page, or (2) remote authenticated users to inject arbitrary web script or HTML via an acknowledgement message, which is not properly handled in the "status" page. | |
| CVE-2016-2057 | Low | 0.21 | 3.3 | 0.00 | Apr 13, 2016 | lib/xymond_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which allows local users to inject arbitrary messages by writing to that queue. | |
| CVE-2013-4173 | 0.00 | — | 0.01 | Oct 11, 2013 | Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command. | ||
| CVE-2011-1716 | 0.00 | — | 0.01 | Apr 18, 2011 | Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Xymon before 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |