Remote code execution

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

Design/Logic Flaw

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php...

CVE-2018-11589

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the...

CVE-2018-11587

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

CVE-2018-11588

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php...

CVE-2018-11589

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the...

CVE-2018-11588

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php...

CVE-2018-11589

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the...

CVE-2018-11587

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

CVE-2018-11588

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php...

CVE-2018-11589

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the...

CVE-2018-11587

CVE-2018-11587 describes remote code execution in Centreon 3.4.6/Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.根据公开资料，影响组件为 Centreon/Centreon Web，漏洞根本原因是对 Virtual Metric 表单中 RPN 值的处理不安全，导致攻击者网络可远程执行代码，影响程度为高/关键。建议升级到包含修复的版本（如 Centreon Web 2.8.24，相关发布 ...

CVE-2018-11589

CVE-2018-11589 affects Centreon 3.4.6 and Centreon Web 2.8.23, with multiple SQL injections via parameters such as viewLogs.php (searchU), GetXmlHost.php (id), ExportCSVServiceData.php (chartId or searchU), and listComponentTemplates/listMetrics (searchCurve/host_id). The issue allows arbitrary S...

CVE-2018-11588

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php...

CVE-2018-11587

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

CVE-2018-11588

Centreon 3.4.6 with Centreon Web 2.8.23 is vulnerable to a stored XSS via an authenticated user injecting a payload into the username or command description. The issue affects files controlling menu and command configuration (www/include/core/menu/menu.php and www/include/configuration/configObje...

CVE-2018-11589: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the...

CVE-2018-11588: Improper Neutralization of Input During Web Page Generation

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php...

PT-2018-10686

Name of the Vulnerable Software and Affected Versions Centreon version 3.4.6 Centreon Web version 2.8.23 Description The issue concerns Remote Code Execution via the RPN value in the Virtual Metric form. This is specifically related to the centreonGraph.class.php file. Recommendations For Centreo...

PT-2018-10688

Name of the Vulnerable Software and Affected Versions Centreon version 3.4.6 Centreon Web version 2.8.23 Description The issue allows for SQL injection attacks through various parameters in different PHP files. Specifically, attacks can be launched via the searchU parameter in "viewLogs.php", the...