https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 17:08:29 +0000 https://cve.radiocsirt.org/vuln/cve-2025-34323 <p><strong>Affected:</strong> Nagios Log Server</p> <p>Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The &#39;www-data&#39; user is a member of the &#39;nagios&#39; group, which has write access to &#39;/usr/local/nagioslogserver/scripts&#39;, while several scripts in this directory are owned by root and may be executed via sudo without a password. A local attacker running as &#39;www-data&#39; can move one of these root-owned scripts to a backup name and create a replacement script with attacker-controlled content at the original path, then invoke it with sudo. This allows arbitrary commands to be executed with root privileges, providing full compromise of the underlying operating system.</p> <p><strong>Affected:</strong> Nagios Log Server</p> <p>Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The &#39;www-data&#39; user is a member of the &#39;nagios&#39; group, which has write access to &#39;/usr/local/nagioslogserver/scripts&#39;, while several scripts in this directory are owned by root and may be executed via sudo without a password. A local attacker running as &#39;www-data&#39; can move one of these root-owned scripts to a backup name and create a replacement script with attacker-controlled content at the original path, then invoke it with sudo. This allows arbitrary commands to be executed with root privileges, providing full compromise of the underlying operating system.</p> https://cve.radiocsirt.org/vuln/cve-2025-34323