CVE-2019-13024

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the...

CVE-2019-13024

Centreon 18.x up to 18.10.5, 19.x up to 19.04.2, and Centreon web prior to 2.8.29 are affected by CVE-2019-13024, a remote command-injection vulnerability. The flaw lets an attacker insert an arbitrary command into the database via the value pair "init_script"-"Monitoring Engine Binary" in main.g...

CVE-2018-19271

Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.28 allows SQL Injection via the main.php searchH parameter...

CVE-2018-19271

Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.28 allows SQL Injection via the main.php searchH parameter...

Multiple SQL Injection Vulnerabilities in Centreon and Centreon Web

Centreon is a suite of open source IT monitoring software that needs to be used with Nagios to manage Nagios via the web web and third-party components to enable monitoring of the network, operating system and applications.Centreon Web is a web-based application for managing Centreon. Multiple SQ...

Centreon Remote Code Execution Vulnerability (CNVD-2018-14217)

Centreon and Centreon Web are both products of the French company Centreon.Centreon formerly Merethis Centreon is a suite of open-source IT monitoring software that is required to be used with Nagios, which it manages via the web, as well as third-party components for monitoring networks, operati...

CVE-2018-11587

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

CVE-2018-11587

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

CVE-2015-7672

Cross-site scripting XSS vulnerability in Centreon 2.6.1 fixed in Centreon 18.10.0 and Centreon web 2.8.27...

Centreon Web Interface 2.5.3 Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Centreon Web Useralias Command Execution', 'Description' = %q Centreon Web Interface 'h00die ', module 'Nicolas CHATELAIN '...

CVE-2015-1560

SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon formerly Merethis Centreon 2.5.4 and earlier fixed in Centreon web 2.7.0 allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php...

CVE-2014-3828

Centreon 2.5.1 and Centreon Enterprise Server 2.2 contain SQL injection vulnerabilities (CVE-2014-3828) that are pre-auth and remotely exploitable. The issues arise in multiple PHP components where unsanitized input is used: index_id (views/graphs/common/makeXML_ListMetrics.php), sid (views/graph...

CVE-2012-5967

SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 fixed in Centreon web 2.6.0 allows remote authenticated users to execute arbitrary SQL commands via the menu parameter...