CVE-2018-21021

Summary of CVE-2018-21021 : Multiple sources confirm a SQL injection vulnerability in Centreon Web (Centreon/Merethis) prior to version 2.8.27. The issue is triggered via the host_id parameter in img_gantt.php, allowing an attacker to inject and potentially execute arbitrary SQL commands. Exploit...

CVE-2018-21021

imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-21021

imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-21020

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place...

CVE-2018-21020

Centreon Web component centreonAuth.class.php contains a PHP type juggling flaw that, before version 2.8.27, can allow an attacker to bypass authentication. The issue is documented across multiple sources (CVE-2018-21020; affected product Centreon Web pre-2.8.27). Impact is authentication bypass ...

CVE-2018-21020

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place...

CVE-2018-21024: Unrestricted Upload of File with Dangerous Type

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

PT-2019-14947

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.27 Description The issue allows authenticated attackers to execute arbitrary code. This is achieved via the command hostaddress parameter in the minPlayCommand.php file. Recommendations For versions prior to...

PT-2019-14945

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.27 Description The issue concerns a predictable token generator in the index.php file. This predictability could potentially be exploited. Recommendations For versions prior to 2.8.27, update to version 2.8.2...

PT-2019-10446

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.27 Description A PHP type juggling issue in the centreonAuth.class.php file allows attackers to bypass existing authentication mechanisms in rare cases. Recommendations For versions prior to 2.8.27, update to...

PT-2019-10450

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.27 Description The issue allows attackers to upload arbitrary files via a POST request to the licenseUpload.php file. Recommendations For versions prior to 2.8.27, update to version 2.8.27 or later to resolve...

PT-2019-10449

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.28 Description The issue allows authenticated attackers to execute arbitrary code. This is achieved via the ns id parameter in the "getStats.php" file. Recommendations For versions prior to 2.8.28, update to...

CVE-2019-17105: Use of Insufficiently Random Values

The token generator in index.php in Centreon Web before 2.8.27 is predictable...

CVE-2019-17106: Cleartext Storage of Sensitive Information

In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components...

PT-2019-14946

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.30 Description The issue allows authenticated attackers to disclose passwords of external components, potentially enabling lateral movement to these components. Recommendations For Centreon Web versions prior...

PT-2019-10448

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.28 Description The issue allows attackers to perform SQL injections via the host id parameter in the makeXML ListServices.php file. Recommendations For versions prior to 2.8.28, update to version 2.8.28 or...

CVE-2018-21023: Improper Control of Generation of Code

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the nsid parameter...

CVE-2018-21022: Improper Neutralization of Special Elements used in an SQL Command

makeXMLListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-21021: Improper Neutralization of Special Elements used in an SQL Command

imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...

CVE-2018-21020: Improper Input Validation

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place...