CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28053
https://notcve.org/view.php?id=CVE-2021-28053
An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A SQL injection vulnerability in "Configuration > Users > Contacts / Users" allows remote authenticated users to execute arbitrary SQL commands via the Additional Information parameters. Se ha detectado un problema en Centreon-Web in Centreon Platform versión 20.10.0. Una vulnerabilidad de inyección SQL en "Configuration ) Users ) Contacts / Users" permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios por medio de los parámetros Additional Information • https://docs.centreon.com/current/en https://github.com/centreon/centreon/releases/tag/20.04.13 https://redshell.co • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28054
https://notcve.org/view.php?id=CVE-2021-28054
An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration > Hosts" allows remote authenticated users to inject arbitrary web script or HTML via the Alias parameter. Se ha detectado un problema en Centreon-Web en Centreon Platform versión 20.10.0. Un problema de tipo Cross-Site Scripting (XSS) almacenado en "Configuración ) Hosts" permite a usuarios remotos autenticados inyectar script web o HTML arbitrario por medio del parámetro Alias • https://docs.centreon.com/current/en https://github.com/centreon/centreon/releases/tag/20.04.13 https://redshell.co • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27676
https://notcve.org/view.php?id=CVE-2021-27676
Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page. Centreon versión 20.10.2, está afectada por una vulnerabilidad de tipo cross-site scripting (XSS). Los parámetros dep_description (Dependency Description) y dep_name (Dependency Name) son vulnerables a ataques de tipo XSS almacenado. • http://centreon.com https://github.com/centreon/centreon/pull/9587 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28055
https://notcve.org/view.php?id=CVE-2021-28055
An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user. Se detectó un problema en Centreon-Web en Centreon Platform versión 20.10.0. La generación de tokens anti-CSRF es predecible, lo que podría permitir ataques de tipo CSRF que agreguen un usuario administrador • https://github.com/centreon/centreon/pull/9612 • CWE-330: Use of Insufficiently Random Values •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-22425
https://notcve.org/view.php?id=CVE-2020-22425
Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command execution. Centreon versión 19.10-3.el7, está afectado por una vulnerabilidad de inyección SQL, donde un usuario autorizado puede inyectar consultas SQL adicionales para llevar a cabo una ejecución de comandos remota • https://code610.blogspot.com/2020/04/postauth-sqli-in-centreon-1910-1el7.html%2C https://github.com/c610/free • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •