CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27676
https://notcve.org/view.php?id=CVE-2021-27676
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page. Centreon versión 20.10.2, está afectada por una vulnerabilidad de tipo cross-site scripting (XSS). Los parámetros dep_description (Dependency Description) y dep_name (Dependency Name) son vulnerables a ataques de tipo XSS almacenado. • http://centreon.com https://github.com/centreon/centreon/pull/9587 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-26804
https://notcve.org/view.php?id=CVE-2021-26804
Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading it in the "Administration/ Parameters/ Images" section of the application. Los permisos no seguros en Centreon Web versiones 19.10.18, 20.04.8 y 20.10.2, permiten a atacantes remotos omitir la comprobación al cambiar cualquier extensión de archivo a ".gif" y luego cargándola en la sección de la aplicación "Administration/ Parameters/ Images" • https://medium.com/%40pedro.ferreira.phf/vulnerability-affecting-some-versions-of-centreon-2b34bd6dc621 • CWE-276: Incorrect Default Permissions •