CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17501
https://notcve.org/view.php?id=CVE-2019-17501
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same. Centreon versión 19.04, permite a atacantes ejecutar comandos arbitrarios del sistema operativo por medio del campo Command Line de main.php?p=60807&type=4 [también se conoce como la pantalla Configuration ) Commands ) Discovery]. • https://gist.github.com/sinfulz/ef49270e245df050af59cc3dd3eefa6b • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-21024
https://notcve.org/view.php?id=CVE-2018-21024
licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request. El archivo licenseUpload.php en Centreon Web versiones anteriores a 2.8.27, permite a atacantes cargar archivos arbitrarios por medio de una petición POST. • http://www.openwall.com/lists/oss-security/2019/10/09/2 https://github.com/centreon/centreon/pull/7085 https://www.openwall.com/lists/oss-security/2019/10/08/1 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-16194
https://notcve.org/view.php?id=CVE-2019-16194
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php. Unas vulnerabilidades de inyección SQL en Centreon versiones hasta 19.04, permiten ataques por medio del parámetro svc_id en el archivo include/tracking/status/Services/xml/makeXMLForOneService.php. • https://github.com/centreon/centreon/pull/7862 https://github.com/centreon/centreon/releases • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 34%CPEs: 1EXPL: 5CVE-2019-13024 – Centreon 19.04 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-13024
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands). Centreon versiones 18.x anteriores a 18.10.6, versiones 19.x anteriores a 19.04.3, y Centreon web anterior a versión 2.8.29, permite al atacante ejecutar comandos del sistema arbitrarios mediante el uso del valor "init_script"-"Monitoring Engine Binary" en el archivo main.get.php para insertar un comando arbitrario en la base de datos, y ejecutándolo para llamar la página vulnerable www/include/configuration/configGenerate/xml/generateFiles.php (que pasa el valor insertado a la base de datos a shell_exec sin sanearlo, lo que permite ejecutar comandos arbitrarios del sistema). Centreon version 19.04 suffers from an authenticated remote code execution vulnerability. • https://www.exploit-db.com/exploits/47069 https://github.com/mhaskar/CVE-2019-13024 http://packetstormsecurity.com/files/153504/Centreon-19.04-Remote-Code-Execution.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.6.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04/centreon-19.04.3.html https://gist.github.com/mhaskar/c4255f6cf45b19b8a852c780f50576da https://github.com/centreon/centreon/pull/7694 h • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19312
https://notcve.org/view.php?id=CVE-2018-19312
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI. Centreon versiones 3.4.x (corregido en Centreon versión 18.10.0 y Centreon web versión 2.8.24), permite una inyección SQL por medio del parámetro searchVM en el URI main.php?p=20408. • http://www.roothc.com.br/1349-2 https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-18.10/centreon-18.10.0.html https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-2.8/centreon-2.8.24.html https://github.com/centreon/centreon/pull/6257 https://github.com/centreon/centreon/pull/6628 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •