CVSS: 10.0EPSS: 46%CPEs: 2EXPL: 4CVE-2014-3828 – Centreon < 2.5.1 / Centreon Enterprise Server < 2.2 - SQL Injection / Command Injection
https://notcve.org/view.php?id=CVE-2014-3828
18 Oct 2014 — Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter t... • https://www.exploit-db.com/exploits/41676 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 34%CPEs: 2EXPL: 2CVE-2014-3829 – Centreon < 2.5.1 / Centreon Enterprise Server < 2.2 - SQL Injection / Command Injection
https://notcve.org/view.php?id=CVE-2014-3829
18 Oct 2014 — displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable. El archivo displayServiceStatus.php en Centreon versión 2.5.1 y Centreon Enterprise Server versión 2.2 (corregido en Centreon web versión 2.5.3), permite a atacantes ejecutar comandos arbitrarios por medio de metacaracteres de shell en... • https://www.exploit-db.com/exploits/41676 • CWE-94: Improper Control of Generation of Code ('Code Injection') •