Seungmyung Lee

**Name of the Vulnerable Software and Affected Versions** Nagios Core versions prior to 4.5.12 **Description** A cross-site request forgery (CSRF) issue exists in the 'cmd.cgi' endpoint. The CSRF protection mechanism fails to properly validate requests when the `NagFormId` cookie is missing. This allows an attacker to send a malicious cross-site POST request that executes arbitrary Nagios commands using the privileges of an authenticated user without their consent. CSRF is a type of attack that tricks a victim into submitting a malicious request. **Recommendations** Update Nagios Core to version 4.5.12 or later.

**Name of the Vulnerable Software and Affected Versions** Nagios Core versions prior to 4.5.13 Nagios XI versions prior to 2026R1.5 **Description** A Cross-Site Request Forgery (CSRF) issue exists in the 'cmd.cgi' endpoint. When the Cookie header is missing, the double-submit cookie protection mechanism can be bypassed by providing identical values for the `NagFormId` and `nagFormId` variables within the POST body. This allows an attacker to execute Nagios commands using the privileges of a currently authenticated user. **Recommendations** Update Nagios Core to version 4.5.13 or later. Update Nagios XI to version 2026R1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Apache APISIX versions 2.12.0 through 3.15.0 **Description** A header injection issue exists in the forward-auth plugin due to improper neutralization of CRLF sequences (Carriage Return Line Feed, a special sequence of characters used to mark the end of a line of text). A remote attacker can exploit this by sending specially crafted HTTP requests to inject malicious headers, potentially bypassing security mechanisms and gaining unauthorized access to protected information. **Recommendations** Upgrade to version 3.16.0.