Code injection

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the nsid parameter...

Sql injection

imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...

Xxe

In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components...

Authentication flaw

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place...

Cross site scripting

Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user...

Sql injection

makeXMLListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the hostid parameter...

CVE-2019-17108

Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user...

CVE-2019-17108

CVE-2019-17108 affects Centreon Web (prior to version 2.8.28). The vulnerability is a Local File Inclusion in brokerPerformance.php, caused by lack of proper validation of client-side data (e.g., filename), which can let an attacker disclose information and potentially trigger a stored XSS on a u...

CVE-2019-17107

CVE-2019-17016, -17017, -17022, -17024, -17026 are addressed in Thunderbird upstream: multiple issues including CSS sanitization bypass on pasting, type confusion in XPCVariant.cpp, memory-safety bugs, and related advisory notes. The connected documents confirm affected product: Thunderbird (and ...

CVE-2019-17106

In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components...

CVE-2019-17106

CVE-2019-17106 affects Centreon Web up to version 2.8.29. The issue is disclosure of external components’ passwords, which authenticated attackers can use to move laterally to external components. The available connected records repeat the same description without adding new technical details (no...

CVE-2018-21023

Centreon Web ≤ 2.8.28 contains a code execution vulnerability in getStats.php via the ns_id parameter. The issue arises from how externally entered data is used to construct a code segment, enabling authenticated attackers to execute arbitrary code. Affected product/version details and CVE descri...

CVE-2018-21023

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the nsid parameter...

CVE-2018-21022

Centreon Web vulnerability CVE-2018-21022: The affected component is makeXML_ListServices.php in Centreon Web, with the root cause being a SQL injection via the host_id parameter. Versions prior to 2.8.28 are affected. Impact is that an attacker could inject SQL commands through the host_id value...

CVE-2018-21022

makeXMLListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-21021

imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-21021

Summary of CVE-2018-21021 : Multiple sources confirm a SQL injection vulnerability in Centreon Web (Centreon/Merethis) prior to version 2.8.27. The issue is triggered via the host_id parameter in img_gantt.php, allowing an attacker to inject and potentially execute arbitrary SQL commands. Exploit...

CVE-2018-21020

Centreon Web component centreonAuth.class.php contains a PHP type juggling flaw that, before version 2.8.27, can allow an attacker to bypass authentication. The issue is documented across multiple sources (CVE-2018-21020; affected product Centreon Web pre-2.8.27). Impact is authentication bypass ...

CVE-2018-21020

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place...

Command injection

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the...