1399 matches found
CVE-2018-21022
makeXMLListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the hostid parameter...
Authentication flaw
In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place...
Code injection
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the commandhostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect...
Code injection
In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files...
Sql injection
imggantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the hostid parameter...
Cross site scripting
Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user...
Code injection
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set...
Sql injection
makeXMLListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the hostid parameter...
Xxe
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components...
Code injection
getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the nsid parameter...
CVE-2019-17108
CVE-2019-17108 affects Centreon Web (prior to version 2.8.28). The vulnerability is a Local File Inclusion in brokerPerformance.php, caused by lack of proper validation of client-side data (e.g., filename), which can let an attacker disclose information and potentially trigger a stored XSS on a u...
CVE-2019-17108
Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user...
CVE-2019-17107
CVE-2019-17016, -17017, -17022, -17024, -17026 are addressed in Thunderbird upstream: multiple issues including CSS sanitization bypass on pasting, type confusion in XPCVariant.cpp, memory-safety bugs, and related advisory notes. The connected documents confirm affected product: Thunderbird (and ...
CVE-2019-17107
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the commandhostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect...
CVE-2019-17106
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components...
CVE-2019-17106
CVE-2019-17106 affects Centreon Web up to version 2.8.29. The issue is disclosure of external components’ passwords, which authenticated attackers can use to move laterally to external components. The available connected records repeat the same description without adding new technical details (no...
CVE-2019-17104
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set...
CVE-2019-17104
Centreon VM (through 19.04.3) is affected by a cookie-configuration issue in the Apache HTTP Server: the HTTPOnly flag is not set, enabling potential theft of cookies. This vulnerability is documented across multiple sources (NVD, Red Hat, GHSA, OSV, CNVD, Veracode, CVE lists) and is tied to Cent...
CVE-2018-21025
CVE-2018-21025 affects Centreon VM up to version 19.04.3. The vulnerability arises from incorrect rights on sourced configuration files in centreon-backup.pl, allowing an attacker to escalate to root via a crafted script. The CVSSv3.1 base score is 9.8 (CRITICAL) with network attack vector, low a...