CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-37558
https://notcve.org/view.php?id=CVE-2021-37558
03 Aug 2021 — A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via the host_name and service_description parameters. The vulnerability can be exploited only when a valid Knowledge Base URL is configured on the Knowledge Base configuration page and points to a MediaWiki instance. This relates to the proxy feature in class/centreon-knowledge/ProceduresProxy.class.php and include/configuration/confi... • https://github.com/centreon/centreon/pull/9796 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 1CVE-2021-37557
https://notcve.org/view.php?id=CVE-2021-37557
03 Aug 2021 — A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the include/views/graphs/generateGraphs/generateImage.php index parameter. Una vulnerabilidad de inyección SQL en la generación de imágenes en Centreon versiones anteriores a 20.04.14, 20.10.8 y 21.04.2, permite a atacantes remotos autenticados (pero con pocos privilegios) ejecutar comandos SQL arbitrarios por med... • https://github.com/centreon/centreon/pull/9787 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 1CVE-2021-37556
https://notcve.org/view.php?id=CVE-2021-37556
03 Aug 2021 — A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the include/reporting/dashboard/csvExport/csv_HostGroupLogs.php start and end parameters. Una vulnerabilidad de inyección SQL en la exportación de informes en Centreon versiones anteriores a 20.04.14, 20.10.8 y 21.04.2, permite a atacantes remotos autenticados (pero con pocos privilegios) ejecutar comandos SQL arb... • https://github.com/centreon/centreon/pull/9781 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28053
https://notcve.org/view.php?id=CVE-2021-28053
16 Jul 2021 — An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration > Users > Contacts / Users" allows remote authenticated users to execute arbitrary SQL commands via the Additional Information parameters. Se ha detectado un problema en Centreon-Web in Centreon Platform versión 20.10.0. Una vulnerabilidad de inyección SQL en "Configuration ) Users ) Contacts / Users" permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios por medio de los ... • https://docs.centreon.com/current/en • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28054
https://notcve.org/view.php?id=CVE-2021-28054
16 Jul 2021 — An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration > Hosts" allows remote authenticated users to inject arbitrary web script or HTML via the Alias parameter. Se ha detectado un problema en Centreon-Web en Centreon Platform versión 20.10.0. Un problema de tipo Cross-Site Scripting (XSS) almacenado en "Configuración ) Hosts" permite a usuarios remotos autenticados inyectar script web o HTML arbitrario por medio del parámetro Alias • https://docs.centreon.com/current/en • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27676
https://notcve.org/view.php?id=CVE-2021-27676
26 May 2021 — Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page. Centreon versión 20.10.2, está afectada por una vulnerabilidad de tipo cross-site scripting (XSS). Los parámetros dep_description (Dependency Description) y dep_name (Dependency Name) son vulnerables a ataques de tipo XSS almac... • http://centreon.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28055
https://notcve.org/view.php?id=CVE-2021-28055
15 Apr 2021 — An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user. Se detectó un problema en Centreon-Web en Centreon Platform versión 20.10.0. La generación de tokens anti-CSRF es predecible, lo que podría permitir ataques de tipo CSRF que agreguen un usuario administrador • https://github.com/centreon/centreon/pull/9612 • CWE-330: Use of Insufficiently Random Values •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-22425
https://notcve.org/view.php?id=CVE-2020-22425
15 Feb 2021 — Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command execution. Centreon versión 19.10-3.el7, está afectado por una vulnerabilidad de inyección SQL, donde un usuario autorizado puede inyectar consultas SQL adicionales para llevar a cabo una ejecución de comandos remota • https://code610.blogspot.com/2020/04/postauth-sqli-in-centreon-1910-1el7.html%2C • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2020-10945
https://notcve.org/view.php?id=CVE-2020-10945
27 May 2020 — Centreon before 19.10.7 exposes Session IDs in server responses. Centreon versiones anteriores a la versión19.10.7, expone los Session IDs en las respuestas del servidor. • https://sysdream.com/news/lab/2020-05-13-cve-2020-10945-centreon-session-id-exposure • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 6%CPEs: 1EXPL: 2CVE-2020-13252
https://notcve.org/view.php?id=CVE-2020-13252
21 May 2020 — Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page. Centreon versiones anteriores a 19.04.15, permite a atacantes remotos ejecutar comandos arbitrarios del Sistema Operativo al colocar metacaracteres de shell en la función RRDdatabase_status_path (por medio de una petición de main.get.php) y luego visitando... • https://engindemirbilek.github.io/centreon-19.10-rce • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •