CVE-2019-17108: Improper Neutralization of Input During Web Page Generation

Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user...

CVE-2018-21023: Improper Control of Generation of Code

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the nsid parameter...

CVE-2018-21021: Improper Neutralization of Special Elements used in an SQL Command

imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...

PT-2019-14948

Name of the Vulnerable Software and Affected Versions Centreon Web versions prior to 2.8.28 Description The issue allows attackers to disclose information or perform a stored XSS attack on a user through local file inclusion in the brokerPerformance.php file. Recommendations For versions prior to...

Command injection

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the...

CVE-2019-13024

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the...

CVE-2019-13024

Centreon 18.x up to 18.10.5, 19.x up to 19.04.2, and Centreon web prior to 2.8.29 are affected by CVE-2019-13024, a remote command-injection vulnerability. The flaw lets an attacker insert an arbitrary command into the database via the value pair "init_script"-"Monitoring Engine Binary" in main.g...

CVE-2018-19271

Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.28 allows SQL Injection via the main.php searchH parameter...

CVE-2018-19271

Centreon 3.4.x fixed in Centreon 18.10.0 and Centreon web 2.8.28 allows SQL Injection via the main.php searchH parameter...

Multiple SQL Injection Vulnerabilities in Centreon and Centreon Web

Centreon is a suite of open source IT monitoring software that needs to be used with Nagios to manage Nagios via the web web and third-party components to enable monitoring of the network, operating system and applications.Centreon Web is a web-based application for managing Centreon. Multiple SQ...

Centreon Remote Code Execution Vulnerability (CNVD-2018-14217)

Centreon and Centreon Web are both products of the French company Centreon.Centreon formerly Merethis Centreon is a suite of open-source IT monitoring software that is required to be used with Nagios, which it manages via the web, as well as third-party components for monitoring networks, operati...

CVE-2018-11587

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

CVE-2018-11587

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php...

CVE-2018-11588

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php...

PT-2018-10686

Name of the Vulnerable Software and Affected Versions Centreon version 3.4.6 Centreon Web version 2.8.23 Description The issue concerns Remote Code Execution via the RPN value in the Virtual Metric form. This is specifically related to the centreonGraph.class.php file. Recommendations For Centreo...

PT-2018-10688

Name of the Vulnerable Software and Affected Versions Centreon version 3.4.6 Centreon Web version 2.8.23 Description The issue allows for SQL injection attacks through various parameters in different PHP files. Specifically, attacks can be launched via the searchU parameter in "viewLogs.php", the...

PT-2018-10687

Name of the Vulnerable Software and Affected Versions Centreon versions 3.4.6 Centreon Web version 2.8.23 Description The issue allows an authenticated user to inject a payload into the username or command description, resulting in stored XSS. This is related to files such as menu.php and...

CVE-2015-7672

Cross-site scripting XSS vulnerability in Centreon 2.6.1 fixed in Centreon 18.10.0 and Centreon web 2.8.27...

Centreon Web Interface 2.5.3 Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Centreon Web Useralias Command Execution', 'Description' = %q Centreon Web Interface 'h00die ', module 'Nicolas CHATELAIN '...

CVE-2015-1560

SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon formerly Merethis Centreon 2.5.4 and earlier fixed in Centreon web 2.7.0 allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php...