CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 1CVE-2012-5967 – Centreon Enterprise Server 2.3.3 < 2.3.9-4 - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2012-5967
SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 (fixed in Centreon web 2.6.0) allows remote authenticated users to execute arbitrary SQL commands via the menu parameter. Una vulnerabilidad de inyección SQL en el archivo menuXML.php en Centreon versiones 2.3.3 hasta 2.3.9-4 (corregido en Centreon web versión 2.6.0), permite a usuarios autenticados remotos ejecutar comandos SQL arbitrarios por medio del parámetro menu. • https://www.exploit-db.com/exploits/23362 http://forge.centreon.com/projects/centreon/repository/revisions/13749 http://www.kb.cert.org/vuls/id/856892 https://github.com/centreon/centreon/commit/434e291eebcd8f56771ac96b37831634fa52b6a8#diff-606758231371c4a66ae2668f7ad2b617 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.0EPSS: 0%CPEs: 45EXPL: 1CVE-2011-4432
https://notcve.org/view.php?id=CVE-2011-4432
www/include/configuration/nconfigObject/contact/DB-Func.php in Merethis Centreon before 2.3.2 does not use a salt during calculation of a password hash, which makes it easier for context-dependent attackers to determine cleartext passwords via a rainbow-table approach. www/include/configuration/nconfigObject/contact/DB-Func.php en Merethis Centreon antes de v2.3.2 no emplea "salt" durante el calculo del hash de una contraseña, lo que hace más sencillo para atacantes dependientes del contexto determinar las contraseñas en texto planto a través de una aproximación de tablas "rainbow". • http://securityreason.com/securityalert/8530 https://www.trustwave.com/spiderlabs/advisories/TWSL2011-017.txt • CWE-310: Cryptographic Issues •
CVSS: 6.5EPSS: 0%CPEs: 45EXPL: 2CVE-2011-4431 – Centreon 2.3.1 - 'command_name' Remote Command Execution
https://notcve.org/view.php?id=CVE-2011-4431
Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary commands via a .. (dot dot) in the command_name parameter. Vulnerabilidad de salto de directorio en main.php en Merethis Centreon antes de v2.3.2 permite a usuarios autenticados remotamente ejecutar comandos de su elección a través de .. (punto punto) en el parámetro command_name • https://www.exploit-db.com/exploits/36293 http://securityreason.com/securityalert/8530 https://www.trustwave.com/spiderlabs/advisories/TWSL2011-017.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 5CVE-2010-1301 – Centreon IT & Network Monitoring 2.1.5 - SQL Injection
https://notcve.org/view.php?id=CVE-2010-1301
SQL injection vulnerability in main.php in Centreon 2.1.5 allows remote attackers to execute arbitrary SQL commands via the host_id parameter. Vulnerabilidad de inyección SQL en main.php en Centreon v2.1.5, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro "host_id". • https://www.exploit-db.com/exploits/11979 http://osvdb.org/63347 http://packetstormsecurity.org/1004-exploits/centreon-sql.txt http://secunia.com/advisories/39236 http://www.exploit-db.com/exploits/11979 http://www.securityfocus.com/bid/39118 https://exchange.xforce.ibmcloud.com/vulnerabilities/57464 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 26EXPL: 0CVE-2009-4368
https://notcve.org/view.php?id=CVE-2009-4368
Multiple unspecified vulnerabilities in Centreon before 2.1.4 have unknown impact and attack vectors in the (1) ping tool, (2) traceroute tool, and (3) ldap import, possibly related to improper authentication. Múltiples vulnerabilidades no especificadas en Centreon versiones anteriores a v2.1.4 tienen un impacto y vectores de ataque desconocidos en (1) herramienta ping, (2) herramienta tool, y (3) importación ldap, posiblemente relacionado con una autenticación no apropiada. • http://osvdb.org/61183 http://secunia.com/advisories/37808 http://www.centreon.com/Development/changelog-2x.html http://www.securityfocus.com/bid/37383 http://www.vupen.com/english/advisories/2009/3578 https://exchange.xforce.ibmcloud.com/vulnerabilities/54893 •