CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 1CVE-2020-13628
https://notcve.org/view.php?id=CVE-2020-13628
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget. Una vulnerabilidad de tipo cross-site scripting (XSS) permite a atacantes remotos inyectar scripts web o HTML arbitrario por medio del parámetro widgetId en el archivo host-monitoring/src/toolbar.php. Esta vulnerabilidad es corregida en las versiones 1.6.4, 18.10.3, 19.04.3 y 19.0.1 del Centreon host-monitoring widget; las versiones 1.6.4, 18.10.5, 19.04.3, 19.10.2 del Centreon service-monitoring widget; y las versiones 1.0.3, 18.10.1, 19.04.1, 19.10.1 del Centreon tactical-overview widget. • https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 1CVE-2020-13627
https://notcve.org/view.php?id=CVE-2020-13627
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget. Una vulnerabilidad de tipo cross-site scripting (XSS) permite a atacantes remotos inyectar scripts web o HTML arbitrario por medio del parámetro widgetId en el archivo host-monitoring/src/toolbar.php. Esta vulnerabilidad es corregida en las versiones 1.6.4, 18.10.3, 19.04.3 y 19.0.1 del Centreon host-monitoring widget; las versiones 1.6.4, 18.10.5, 19.04.3, 19.10.2 del Centreon service-monitoring widget; y las versiones 1.0.3, 18.10.1, 19.04.1, 19.10.1 del Centreon tactical-overview widget. • https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 12EXPL: 1CVE-2020-10946
https://notcve.org/view.php?id=CVE-2020-10946
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget. Una vulnerabilidad de tipo cross-site scripting (XSS), permite a atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro page en el archivo service-monitoring/src/index.php. Esta vulnerabilidad es corregida en las versiones 1.6.4, 18.10.3, 19.04.3 y 19.0.1 del Centreon host-monitoring widget; las versiones 1.6.4, 18.10.5, 19.04.3, 19.10.2 del Centreon service-monitoring widget; y las versiones 1.0.3, 18.10.1, 19.04.1, 19.10.1 del Centreon tactical-overview widget. • https://sysdream.com/news/lab/2020-05-13-cve-2020-10946-several-cross-site-scripting-xss-vulnerabilities-in-centreon • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 8EXPL: 0CVE-2020-10945
https://notcve.org/view.php?id=CVE-2020-10945
Centreon before 19.10.7 exposes Session IDs in server responses. Centreon versiones anteriores a la versión19.10.7, expone los Session IDs en las respuestas del servidor. • https://sysdream.com/news/lab/2020-05-13-cve-2020-10945-centreon-session-id-exposure • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •