Centreon
Page 2 of 2 — Centreon CVEs from a corpus of 128, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-21024 | Critical | 9.8 | 2019-10-08 | licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request. |
CVE-2019-17108 | Medium | 6.1 | 2019-10-08 | Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user. |
CVE-2019-17107 | High | 8.8 | 2019-10-08 | minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sou… |
CVE-2019-17106 | Medium | 6.5 | 2019-10-08 | In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components. |
CVE-2019-17104 | High | 7.5 | 2019-10-08 | In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set. |
CVE-2018-21025 | Critical | 9.8 | 2019-10-08 | In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files. |
CVE-2018-21023 | High | 8.8 | 2019-10-08 | getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter. |
CVE-2018-21022 | High | 8.8 | 2019-10-08 | makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter. |
CVE-2018-21021 | High | 8.8 | 2019-10-08 | img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter. |
CVE-2018-21020 | High | 7.5 | 2019-10-08 | In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechani… |
CVE-2019-16194 | Critical | 9.8 | 2019-09-25 | SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.p… |
CVE-2019-13024 | High | 8.8 | 2019-07-01 | Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "… |
CVE-2018-19312 | High | 8.8 | 2018-11-16 | Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI. |
CVE-2018-19311 | Medium | 5.4 | 2018-11-16 | Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details >… |
CVE-2018-19281 | Critical | 9.8 | 2018-11-14 | Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection. |
CVE-2018-19280 | Medium | 6.1 | 2018-11-14 | Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro. |
CVE-2018-19271 | High | 8.8 | 2018-11-14 | Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter. |
CVE-2018-11589 | Critical | 9.8 | 2018-06-25 | Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id paramete… |
CVE-2018-11588 | Medium | 5.4 | 2018-06-25 | Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in… |
CVE-2018-11587 | Critical | 9.8 | 2018-06-25 | There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php. |
CVE-2015-7672 | Medium | 5.4 | 2017-09-07 | Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27). |
CVE-2015-1561 | | 2015-07-14 | The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreo… | |
CVE-2015-1560 | | 2015-07-14 | SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in… | |
CVE-2012-5967 | | 2012-12-19 | SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 (fixed in Centreon web 2.6.0) allows remote authenticated users to execute arbitra… | |
CVE-2008-1179 | | 2008-03-06 | Multiple cross-site scripting (XSS) vulnerabilities in include/common/javascript/color_picker.php in Centreon 1.4.2.3 and earlier allow remote attackers to inj… | |
CVE-2008-1178 | | 2008-03-06 | Directory traversal vulnerability in include/doc/index.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) i… | |
CVE-2008-1119 | | 2008-03-03 | Directory traversal vulnerability in include/doc/get_image.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a .. (dot do… | |
CVE-2007-6485 | | 2007-12-20 | Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code via a URL in the file… |