CVSS: 9.0EPSS: 70%CPEs: 1EXPL: 1CVE-2020-9463
https://notcve.org/view.php?id=CVE-2020-9463
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internal.php?object=centreon_configuration_remote request. Centreon versión 19.10, permite a usuarios autentificados remotos ejecutar comandos arbitrarios del Sistema Operativo por medio de metacaracteres de shell en el campo server_ip en los datos JSON en una petición de api/internal.php?object=centreon_configuration_remote. • https://code610.blogspot.com/2020/02/postauth-rce-in-centreon-1910.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-20327
https://notcve.org/view.php?id=CVE-2019-20327
Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is a setuid executable allowing execution of Perl scripts with root privileges.) Unos permisos no seguros en cwrapper_perl en Centreon Infrastructure Monitoring Software versiones hasta 19.10, permiten a atacantes locales alcanzar privilegios. (cwrapper_perl es un ejecutable setuid que permite la ejecución de scripts Perl con privilegios root). • https://gist.github.com/Diefunction/9237f46b8659a65ab08de8ec9c258139 https://www.centreon.com/en • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2019-16195
https://notcve.org/view.php?id=CVE-2019-16195
Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields. Centreon versiones anteriores a la versión 2.8.30, versiones 18.x anteriores a 18.10.8 y versiones 19.x anteriores a 19.04.5, permite un ataque de tipo XSS por medio de un alias myAccount y campos de nombre. • https://github.com/centreon/centreon/pull/7876 https://github.com/centreon/centreon/pull/7877 https://github.com/centreon/centreon/releases/tag/18.10.8 https://github.com/centreon/centreon/releases/tag/19.04.5 https://github.com/centreon/centreon/releases/tag/2.8.30 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17501
https://notcve.org/view.php?id=CVE-2019-17501
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same. Centreon versión 19.04, permite a atacantes ejecutar comandos arbitrarios del sistema operativo por medio del campo Command Line de main.php?p=60807&type=4 [también se conoce como la pantalla Configuration ) Commands ) Discovery]. • https://gist.github.com/sinfulz/ef49270e245df050af59cc3dd3eefa6b • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-21024
https://notcve.org/view.php?id=CVE-2018-21024
licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request. El archivo licenseUpload.php en Centreon Web versiones anteriores a 2.8.27, permite a atacantes cargar archivos arbitrarios por medio de una petición POST. • http://www.openwall.com/lists/oss-security/2019/10/09/2 https://github.com/centreon/centreon/pull/7085 https://www.openwall.com/lists/oss-security/2019/10/08/1 • CWE-434: Unrestricted Upload of File with Dangerous Type •