CVE-2019-17108: Improper Neutralization of Input During Web Page Generation

Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user...

CVE-2018-21021: Improper Neutralization of Special Elements used in an SQL Command

imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...

CVE-2019-17105: Use of Insufficiently Random Values

The token generator in index.php in Centreon Web before 2.8.27 is predictable...

CVE-2018-21020: Improper Input Validation

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place...

Command injection

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the...

CVE-2019-13024

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the...

CVE-2019-13024

Centreon 18.x up to 18.10.5, 19.x up to 19.04.2, and Centreon web prior to 2.8.29 are affected by CVE-2019-13024, a remote command-injection vulnerability. The flaw lets an attacker insert an arbitrary command into the database via the value pair "init_script"-"Monitoring Engine Binary" in main.g...

CVE-2018-19271

Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.28 allows SQL Injection via the main.php searchH parameter...

CVE-2018-19271

Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.28 allows SQL Injection via the main.php searchH parameter...

Multiple SQL Injection Vulnerabilities in Centreon and Centreon Web

Centreon is a suite of open source IT monitoring software that needs to be used with Nagios to manage Nagios via the web web and third-party components to enable monitoring of the network, operating system and applications.Centreon Web is a web-based application for managing Centreon. Multiple SQ...

Centreon Remote Code Execution Vulnerability (CNVD-2018-14217)

Centreon and Centreon Web are both products of the French company Centreon.Centreon formerly Merethis Centreon is a suite of open-source IT monitoring software that is required to be used with Nagios, which it manages via the web, as well as third-party components for monitoring networks, operati...

CVE-2018-11587

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

CVE-2018-11587

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

CVE-2015-7672

Cross-site scripting XSS vulnerability in Centreon 2.6.1 fixed in Centreon 18.10.0 and Centreon web 2.8.27...

Centreon Web Interface 2.5.3 Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Centreon Web Useralias Command Execution', 'Description' = %q Centreon Web Interface 'h00die ', module 'Nicolas CHATELAIN '...

CVE-2015-1560

SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon formerly Merethis Centreon 2.5.4 and earlier fixed in Centreon web 2.7.0 allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php...

CVE-2014-3828

Centreon 2.5.1 and Centreon Enterprise Server 2.2 contain SQL injection vulnerabilities (CVE-2014-3828) that are pre-auth and remotely exploitable. The issues arise in multiple PHP components where unsanitized input is used: index_id (views/graphs/common/makeXML_ListMetrics.php), sid (views/graph...

CVE-2012-5967

SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 fixed in Centreon web 2.6.0 allows remote authenticated users to execute arbitrary SQL commands via the menu parameter...