Veille CVE

Semaine du 15 février au 21 février 2021

3 CVE sur 3

Critique 0 Élevée 3 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2021-21315 7.8 Élevée Exploitée

    sebhildebrandt systeminformation · Systeminformation systeminformation · Apache cordova

    The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

  2. CVE-2021-25298 8.8 Élevée Exploitée

    Nagios nagios xi

    Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

  3. CVE-2021-25297 8.8 Élevée Exploitée

    Nagios nagios xi

    Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.