CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-15299
https://notcve.org/view.php?id=CVE-2019-15299
24 Feb 2020 — An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database becomes blank when it should be NULL. This makes it possible to partially bypass authentication. Se detectó un problema en Centreon Web versiones hasta 19.04.3. Cuando un usuario cambia su contraseña sobre su página de perfil, el campo contact_autologin_key en la base de datos pasa a blanco cuando debería ser NULL. • https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 3%CPEs: 4EXPL: 0CVE-2019-15298
https://notcve.org/view.php?id=CVE-2019-15298
27 Nov 2019 — A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the Centreon administration interface. This is the mibs management feature that contains a file filing form. At the time of submission of a file, the mnftr parameter is sent to the page and is not filtered properly. • https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-15300
https://notcve.org/view.php?id=CVE-2019-15300
27 Nov 2019 — A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query. Se encontró un problema en Centreon Web versiones hasta la versión 19.04.3. Una inyección SQL autenticada está presente en la página include/Administration/parameters/ldap/xml/ldap_host.php. • https://documentation.centreon.com/docs/centreon/en/latest/release_notes/centreon-19.04.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 1%CPEs: 4EXPL: 4CVE-2019-16405 – Centreon 19.04 - Authenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-16405
21 Nov 2019 — Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same. Centreon Web anterior a la versión 2.8.30, 18.10.x anterior a la versión 18.10.8, 19.04.x anterior a la versión 19.04.5 y 19.10.x anterior a la versión 19.10.2 permite la ejecución remota de código por parte de un administrador ... • https://www.exploit-db.com/exploits/47948 •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-17105
https://notcve.org/view.php?id=CVE-2019-17105
08 Oct 2019 — The token generator in index.php in Centreon Web before 2.8.27 is predictable. El generador de tokens en el archivo index.php en Centreon Web versiones anteriores a 2.8.27 es predecible. • http://www.openwall.com/lists/oss-security/2019/10/09/2 • CWE-330: Use of Insufficiently Random Values •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2019-17108
https://notcve.org/view.php?id=CVE-2019-17108
08 Oct 2019 — Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user. La inclusión de archivos locales en el archivo brokerPerformance.php en Centreon Web versiones anteriores a 2.8.28, permite a atacantes revelar información o realizar un ataque de tipo XSS almacenado sobre un usuario. • http://www.openwall.com/lists/oss-security/2019/10/09/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2019-17107
https://notcve.org/view.php?id=CVE-2019-17107
08 Oct 2019 — minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect. El archivo minPlayCommand.php en Centreon Web versiones anteriores a 2.8.27, permite a atacantes autenticados ejecutar código arbitrario por medio del parámetro command_hostaddress. NOTA: algunas fuentes han listado el CVE-2019-17017 para esto, pero eso es incorrecto. • http://www.openwall.com/lists/oss-security/2019/10/09/2 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17106
https://notcve.org/view.php?id=CVE-2019-17106
08 Oct 2019 — In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components. En Centreon Web versiones hasta 2.8.29, la divulgación de las contraseñas de los componentes externos permite a atacantes autenticados moverse lateralmente en los componentes externos. • http://www.openwall.com/lists/oss-security/2019/10/09/2 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-21023
https://notcve.org/view.php?id=CVE-2018-21023
08 Oct 2019 — getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter. El archivo getStats.php en Centreon Web versiones anteriores a 2.8.28, permite a atacantes autenticados ejecutar código arbitrario por medio del parámetro ns_id. • http://www.openwall.com/lists/oss-security/2019/10/09/2 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-21022
https://notcve.org/view.php?id=CVE-2018-21022
08 Oct 2019 — makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter. El archivo makeXML_ListServices.php en Centreon Web versiones anteriores a 2.8.28, permite a atacantes realizar inyecciones SQL por medio del parámetro host_id. • http://www.openwall.com/lists/oss-security/2019/10/09/2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •