CVE-2021-37346

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-373477.8Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it rec CVE-2021-373487.5Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php.CVE-2021-373497.8Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the databas CVE-2021-37354.4A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-d CVE-2021-373509.8Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.CVE-2021-373515.3Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a craf CVE-2021-373526.1An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. To exploit the vulnerability, an attack CVE-2021-373539.8Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php.CVE-2021-373549.8Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable. This vuln CVE-2021-373589.8SQL Injection in SEACMS v210530 (2021-05-30) allows remote attackers to execute arbitrary code via the component "admin_ajax.php?action=chec CVE-2021-37365.5A flaw was found in the Linux kernel. A memory leak problem was found in mbochs_ioctl in samples/vfio-mdev/mbochs.c in Virtual Function I/O CVE-2021-373637.8An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.exe file located in b