Code injection

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the nsid parameter...

Xxe

In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components...

CVE-2019-17108

CVE-2019-17108 affects Centreon Web (prior to version 2.8.28). The vulnerability is a Local File Inclusion in brokerPerformance.php, caused by lack of proper validation of client-side data (e.g., filename), which can let an attacker disclose information and potentially trigger a stored XSS on a u...

CVE-2019-17108

Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user...

CVE-2019-17107

CVE-2019-17016, -17017, -17022, -17024, -17026 are addressed in Thunderbird upstream: multiple issues including CSS sanitization bypass on pasting, type confusion in XPCVariant.cpp, memory-safety bugs, and related advisory notes. The connected documents confirm affected product: Thunderbird (and ...

CVE-2019-17106

In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components...

CVE-2019-17106

CVE-2019-17106 affects Centreon Web up to version 2.8.29. The issue is disclosure of external components’ passwords, which authenticated attackers can use to move laterally to external components. The available connected records repeat the same description without adding new technical details (no...

CVE-2018-21023

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the nsid parameter...

CVE-2018-21023

Centreon Web ≤ 2.8.28 contains a code execution vulnerability in getStats.php via the ns_id parameter. The issue arises from how externally entered data is used to construct a code segment, enabling authenticated attackers to execute arbitrary code. Affected product/version details and CVE descri...

CVE-2018-21022

makeXMLListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-21022

Centreon Web vulnerability CVE-2018-21022: The affected component is makeXML_ListServices.php in Centreon Web, with the root cause being a SQL injection via the host_id parameter. Versions prior to 2.8.28 are affected. Impact is that an attacker could inject SQL commands through the host_id value...

CVE-2018-21021

Summary of CVE-2018-21021 : Multiple sources confirm a SQL injection vulnerability in Centreon Web (Centreon/Merethis) prior to version 2.8.27. The issue is triggered via the host_id parameter in img_gantt.php, allowing an attacker to inject and potentially execute arbitrary SQL commands. Exploit...

CVE-2018-21021

imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-21020

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place...

CVE-2018-21020

Centreon Web component centreonAuth.class.php contains a PHP type juggling flaw that, before version 2.8.27, can allow an attacker to bypass authentication. The issue is documented across multiple sources (CVE-2018-21020; affected product Centreon Web pre-2.8.27). Impact is authentication bypass ...

CVE-2018-21023: Improper Control of Generation of Code

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the nsid parameter...

CVE-2018-21022: Improper Neutralization of Special Elements used in an SQL Command

makeXMLListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-21024: Unrestricted Upload of File with Dangerous Type

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

CVE-2019-17107: Improper Neutralization of Special Elements used in an OS Command

minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the commandhostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect...

CVE-2019-17106: Cleartext Storage of Sensitive Information

In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components...