Centreon Operating System Command Injection Vulnerability

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . A security vulnerability exists in Centreon version 19.04. An attacker can use this...

CVE-2019-17501

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 aka the Configuration Commands Discovery screen. CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same...

Design/Logic Flaw

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 aka the Configuration Commands Discovery screen. CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same...

Privilege Escalation

centreon/centreon is vulnerable to privilege escalation. The centreon-backup.pl script that is executed as root as a cronjob allows attackers obtain root privileges by modifying the contents of the overly-permissive configuration file /etc/centreon/conf.pm...

Information Disclosure

centreon/centreon is vulnerable to information disclosure. The cleartext passwords of external components are returned in the server response in host configurations, allowing authenticated attackers to gain unauthorized access to external components...

Local File Inclusion

centreon/centreon is vulnerable to local file inclusion. Lack of validation of a filename in brokerPerformance.php allows an attacker to include a malicious file containing Javascript code on the server which was uploaded prior to the attack, potentially leading to execution of arbitrary Javascri...

Insecure Cookies Configuration

centreon/centreon uses an insecure cookie configuration. The cookies are not configured to include the HTTPOnly flag, which would allow attacker to steal HTTP cookie information in the event of a successful cross-site scripting attack...

OS Command Injection

centreon/centreon is vulnerable to OS command injection. Lack of sanitization allows an attacker to inject and execute arbitrary OS commands on the system in minPlayCommand.php...

SQL Injection

centreon/centreon is vulnerable to SQL injection. An attacker is able to inject and execute arbitrary SQL commands via the hostid parameter...

Remote Code Execution.

Centreon Web is vulnerable to remote code execution RCE. The attacker can inject malicious code through nsid parameter in getStats.php...

Authentication Bypass

Centreon Web is vulnerable to authentication bypass. The vulnerability exists due to a type juggling error in centreonAuth.class.php...

SQL Injection

Centreon Web is vulnerable to SQL injection. The hostid parameter in makeXMLListServices.php is directly appended to the SQL query, allowing an attacker to inject and execute arbitrary SQL script through the affected parameter...

CVE-2019-17105

The token generator in index.php in Centreon Web before 2.8.27 is predictable...

CVE-2019-17105

The token generator in index.php in Centreon Web before 2.8.27 is predictable...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

Cross site request forgery (csrf)

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

Code injection

The token generator in index.php in Centreon Web before 2.8.27 is predictable...

CVE-2019-17105

The token generator in index.php in Centreon Web before 2.8.27 is predictable...

CVE-2019-17105

Centreon Web prior to 2.8.27 is affected by CVE-2019-17105 where the token generator in index.php is predictable. The issue is documented as a predictable token generator, enabling potential token guessing that could enable unauthorized access or session-related abuse. Connected sources also desc...