Tisha Manandhar

**Name of the Vulnerable Software and Affected Versions** Nagios Fusion versions prior to 4.2.0 **Description** Nagios Fusion versions prior to 4.2.0 have a reflected cross-site scripting (XSS) issue in the license key configuration process. This allows an attacker to execute scripts in a user's browser by tricking them into following a specially crafted URL. Successful exploitation can lead to the theft of credentials or session information, potentially granting unauthorized administrative access. **Recommendations** Update to Nagios Fusion version 4.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Nagios Fusion versions prior to 4.2.0 **Description** Nagios Fusion versions prior to 4.2.0 have a stored cross-site scripting (XSS) issue in the LDAP/AD authentication-server configuration. User input that is not properly sanitized can be stored and then displayed in the administrative user interface, which can lead to the execution of JavaScript in the browsers of users who view the affected page. An attacker who can add authentication servers using LDAP/AD integration could persist a malicious payload that runs in the context of other users’ browsers. **Recommendations** Update Nagios Fusion to version 4.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Nagios Fusion versions prior to 4.2.0 **Description** Nagios Fusion versions prior to 4.2.0 contain a stored cross-site scripting (XSS) issue when adding or configuring Email Settings. Insufficient input sanitization allows malicious code to be stored and executed in the browser of users viewing the affected page. An attacker could exploit this by modifying SMTP/email settings or manipulating sendmail configuration fields to inject and persist a malicious payload. **Recommendations** Update to Nagios Fusion version 4.2.0 or later.

**Name of the Vulnerable Software and Affected Versions** Nagios Network Analyzer versions prior to 2024R1 **Description** Nagios Network Analyzer is susceptible to a cross-site scripting (XSS) issue through the Percentile Calculator menu. This occurs due to inadequate validation or escaping of user-provided input, potentially enabling an attacker to inject and execute arbitrary script within a victim’s browser. **Recommendations** Update to version 2024R1 or later.

**Name of the Vulnerable Software and Affected Versions** Nagios Network Analyzer versions prior to 2024R1 **Description** The software contains a stored cross-site scripting (XSS) issue within the Source Groups page, specifically in the percentile calculator menu. An attacker can inject a malicious payload that is stored by the application and executed when other users view the affected page, running the script within the victim’s browser. **Recommendations** Update to version 2024R1 or later.

**Name of the Vulnerable Software and Affected Versions** Super Store Finder versions 3.6 and below **Description** The issue is related to a SQL injection vulnerability. It can be exploited via the `Search` parameter at the "/admin/stores.php" API endpoint. **Recommendations** For Super Store Finder versions 3.6 and below, consider restricting access to the "/admin/stores.php" endpoint until a patch is available. As a temporary workaround, avoid using the `Search` parameter in the affected endpoint to minimize the risk of exploitation.