CveMateVulnerability intelligence

Centreon vulnerabilities

128 vulnerabilities

Known vulnerabilities in Centreon products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 16 products.

Products

16

Centreon70 vulnerabilities
Centreon Web57 vulnerabilities
Infra Monitoring21 vulnerabilities
Web7 vulnerabilities
Centreon Host Monitoring Widget3 vulnerabilities
Centreon Service Monitoring Widget3 vulnerabilities
Centreon Tactical Overview Widget3 vulnerabilities
Open Tickets3 vulnerabilities
Awie2 vulnerabilities
Centreon Vm2 vulnerabilities
Centreon BAM1 vulnerabilities
Centreon Open Tickets On Central Server1 vulnerabilities
Centreon Web On Central Server1 vulnerabilities
Dynamic Service Management1 vulnerabilities
Infra Monitoring Open Tickets1 vulnerabilities
Widget Host Monitoring1 vulnerabilities

CVE-2018-21021centreoncentreon_web7y ago08-10-2019 12:11

img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.CVE-2018-21020centreoncentreon_web7y ago08-10-2019 12:08

In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place.CVE-2018-21024centreoncentreon7y ago08-10-2019 14:32

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.CVE-2018-21022centreoncentreon_web7y ago08-10-2019 12:14

makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.CVE-2018-21023centreoncentreon_web7y ago08-10-2019 12:17

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.CVE-2018-21025centreoncentreon_vm7y ago08-10-2019 12:18

In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.CVE-2018-19280centreoncentreon7y ago14-11-2018 20:00

Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.CVE-2018-19271centreoncentreon7y ago14-11-2018 11:00

Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.CVE-2018-19281centreoncentreon7y ago14-11-2018 20:00

Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.CVE-2018-19312centreoncentreon7y ago16-11-2018 19:00

Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.CVE-2018-19311centreoncentreon7y ago16-11-2018 19:00

Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.CVE-2018-11588centreoncentreon+18y ago25-06-2018 18:00

Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php.CVE-2018-11589centreoncentreon+18y ago25-06-2018 18:00

Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.CVE-2018-11587centreoncentreon+18y ago25-06-2018 18:00

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.CVE-2021-26804centreoncentreon_web5y ago04-05-2021 16:49

Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any file extension to ".gif", then uploading it in the "Administration/ Parameters/ Images" section of the application.CVE-2021-37556centreoncentreon5y ago03-08-2021 15:31

A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the include/reporting/dashboard/csvExport/csv_HostGroupLogs.php start and end parameters.CVE-2021-37558centreoncentreon5y ago03-08-2021 15:37

A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via the host_name and service_description parameters. The vulnerability can be exploited only when a valid Knowledge Base URL is configured on the Knowledge Base configuration page and points to a MediaWiki instance. This relates to the proxy feature in class/centreon-knowledge/ProceduresProxy.class.php and include/configuration/configKnowledge/proxy/proxy.php.CVE-2021-37557centreoncentreon5y ago03-08-2021 15:34

A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the include/views/graphs/generateGraphs/generateImage.php index parameter.CVE-2021-27676centreoncentreon5y ago26-05-2021 10:20

Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notifications > Hosts page.CVE-2021-28055centreoncentreon5y ago15-04-2021 18:29

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user.