CVE-2020-15902

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://insinuator.net/2020/07/security-advisories-for-nagios-xi/Third Party Advisory
https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory
https://www.nagios.com/products/security/Vendor Advisory
https://insinuator.net/2020/07/security-advisories-for-nagios-xi/Third Party Advisory
https://www.nagios.com/downloads/nagios-xi/change-log/Release Notes, Vendor Advisory
https://www.nagios.com/products/security/Vendor Advisory

Timeline

Published: Jul 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-159039.8An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some i CVE-2020-159047.8A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a CVE-2020-159069.8tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts.CVE-2020-159076.1In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or folder names containing CVE-2020-159087.5tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive.CVE-2020-159098.8SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cook CVE-2020-15915.4A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web req CVE-2020-159104.7SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the co CVE-2020-159126.5Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the ven CVE-2020-159145.4A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allow a remote attacker CVE-2020-159169.8goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell CVE-2020-159179.8common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.