CVSS: 6.5EPSS: 0%CPEs: 45EXPL: 2CVE-2011-4431 – Centreon 2.3.1 - 'command_name' Remote Command Execution
https://notcve.org/view.php?id=CVE-2011-4431
Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary commands via a .. (dot dot) in the command_name parameter. Vulnerabilidad de salto de directorio en main.php en Merethis Centreon antes de v2.3.2 permite a usuarios autenticados remotamente ejecutar comandos de su elección a través de .. (punto punto) en el parámetro command_name • https://www.exploit-db.com/exploits/36293 http://securityreason.com/securityalert/8530 https://www.trustwave.com/spiderlabs/advisories/TWSL2011-017.txt • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 5CVE-2010-1301 – Centreon IT & Network Monitoring 2.1.5 - SQL Injection
https://notcve.org/view.php?id=CVE-2010-1301
SQL injection vulnerability in main.php in Centreon 2.1.5 allows remote attackers to execute arbitrary SQL commands via the host_id parameter. Vulnerabilidad de inyección SQL en main.php en Centreon v2.1.5, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro "host_id". • https://www.exploit-db.com/exploits/11979 http://osvdb.org/63347 http://packetstormsecurity.org/1004-exploits/centreon-sql.txt http://secunia.com/advisories/39236 http://www.exploit-db.com/exploits/11979 http://www.securityfocus.com/bid/39118 https://exchange.xforce.ibmcloud.com/vulnerabilities/57464 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •