CVE-2018-18245

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results, as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html
https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180026.txtExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/12/msg00014.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html
https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180026.txtExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/12/msg00014.htmlMailing List, Third Party Advisory

Timeline

Published: Dec 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-182466.5Icinga Web 2 before 2.6.2 has CSRF via /icingaweb2/config/moduledisable?name=monitoring to disable the monitoring module, or via /icingaweb2 CVE-2018-182475.4Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.CVE-2018-182486.1Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/mon CVE-2018-182499.8Icinga Web 2 before 2.6.2 allows injection of PHP ini-file directives via vectors involving environment variables as the channel to send inf CVE-2018-18255.4IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav CVE-2018-182507.5Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as the Name of a Navig CVE-2018-182519.8Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. The Visio CVE-2018-182527.8An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe provides "NT AUTHORITY\SYSTEM" access to unprivileged users CVE-2018-182537.0An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged CVE-2018-182547.8An issue was discovered in CapMon Access Manager 5.4.1.1005. An unprivileged user can read the cal_whitelist table in the Custom App Launche CVE-2018-182557.8An issue was discovered in CapMon Access Manager 5.4.1.1005. The client applications of AccessManagerCoreService.exe communicate with this s CVE-2018-182567.8An issue was discovered in CapMon Access Manager 5.4.1.1005. A regular user can obtain local administrator privileges if they run any whitel