CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28053
https://notcve.org/view.php?id=CVE-2021-28053
16 Jul 2021 — An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration > Users > Contacts / Users" allows remote authenticated users to execute arbitrary SQL commands via the Additional Information parameters. Se ha detectado un problema en Centreon-Web in Centreon Platform versión 20.10.0. Una vulnerabilidad de inyección SQL en "Configuration ) Users ) Contacts / Users" permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios por medio de los ... • https://docs.centreon.com/current/en • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28054
https://notcve.org/view.php?id=CVE-2021-28054
16 Jul 2021 — An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration > Hosts" allows remote authenticated users to inject arbitrary web script or HTML via the Alias parameter. Se ha detectado un problema en Centreon-Web en Centreon Platform versión 20.10.0. Un problema de tipo Cross-Site Scripting (XSS) almacenado en "Configuración ) Hosts" permite a usuarios remotos autenticados inyectar script web o HTML arbitrario por medio del parámetro Alias • https://docs.centreon.com/current/en • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27676
https://notcve.org/view.php?id=CVE-2021-27676
26 May 2021 — Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page. Centreon versión 20.10.2, está afectada por una vulnerabilidad de tipo cross-site scripting (XSS). Los parámetros dep_description (Dependency Description) y dep_name (Dependency Name) son vulnerables a ataques de tipo XSS almac... • http://centreon.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28055
https://notcve.org/view.php?id=CVE-2021-28055
15 Apr 2021 — An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user. Se detectó un problema en Centreon-Web en Centreon Platform versión 20.10.0. La generación de tokens anti-CSRF es predecible, lo que podría permitir ataques de tipo CSRF que agreguen un usuario administrador • https://github.com/centreon/centreon/pull/9612 • CWE-330: Use of Insufficiently Random Values •