Skip to content
OpenAdvisories

Package · Packagist

centreon/centreon

27 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

27 results · Feed

  • High 8.8
    CVE-2024-23119

    Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability

    Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific …

    Centreon Centreon centreon/centreon Packagist
  • High 7.2
    CVE-2024-23118 EPSS 53%

    Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability

    Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The spe…

    Centreon Centreon centreon/centreon Packagist
  • High 7.2
    CVE-2024-23117 EPSS 53%

    Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability

    Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The …

    Centreon Centreon centreon/centreon Packagist
  • High 7.2
    CVE-2024-23116 EPSS 53%

    Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability

    Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific fl…

    Centreon Centreon centreon/centreon Packagist
  • High 7.2
    CVE-2024-23115 EPSS 67%

    Centreon updateGroups SQL Injection Remote Code Execution Vulnerability

    Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw ex…

    Centreon Centreon centreon/centreon Packagist
  • High 8.8
    CVE-2024-0637 EPSS 72%

    Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability

    Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw…

    Centreon Centreon centreon/centreon Packagist
  • Medium 6.3
    CVE-2022-3827

    centreon Contact Groups Form formContactGroup.php sql injection

    A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of the component Contact Groups Form. The manipulation of the argument cg_id leads to sql injection. The attack c…

    centreon/centreon Packagist
  • Medium 5.4
    CVE-2022-40044

    Centreon contains cross-site scripting vulnerability via esc_name parameter

    Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via i…

    centreon/centreon Packagist
  • High 8.8
    CVE-2022-40043

    Centreon SQL Injection vulnerability via esc_name parameter

    Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations.

    centreon/centreon Packagist
  • High 8.8
    CVE-2020-22345

    OS Command Injection in Centreon

    /graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.

    centreon/centreon Packagist
  • Medium 5.4
    CVE-2021-27676

    Cross-site scripting in Centreon

    Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. The dep_description (Dependency Description) and dep_name (Dependency Name) parameters are vulnerable to stored XSS. A user has to log in and go to the Configuration > Notific…

    centreon/centreon Packagist
  • Medium 6.5
    CVE-2021-28055

    Predictable CSRF tokens in centreon/centreon

    An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user.

    centreon/centreon Packagist
  • Medium 4.3
    CVE-2020-10945

    Centreon Sensitive Data Exposure vulnerability

    Centreon before 19.10.7 exposes Session IDs in server responses.

    centreon/centreon centreon-engine Ubuntu Packagist
  • High 8.8
    CVE-2020-13252

    Command Injection in Centreon

    Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.

    centreon/centreon Packagist
  • High 7.2
    CVE-2019-16405 Public exploit EPSS 27%

    Improper Input Validation in Centreon Web

    Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one anot…

    centreon/centreon Packagist
  • Medium 6.5
    CVE-2019-17106

    Centreon Sensitive Data Exposure

    In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.

    centreon/centreon Packagist
  • High 7.5
    CVE-2019-17104

    Centreon Does Not Set HTTPOnly Flag

    In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.

    centreon/centreon Packagist
  • Critical 9.8
    CVE-2018-21025

    Centreon Privilege Escalation

    In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.

    centreon/centreon Packagist
  • Critical 9.8
    CVE-2019-16194

    SQL injection in Centreon

    SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.

    centreon/centreon Packagist
  • Medium 5.4
    CVE-2018-19311

    Centreon XSS Vulnerability

    Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.

    centreon/centreon Packagist
  • High 8.8
    CVE-2018-19312

    Centreon SQL Injection

    Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.

    centreon/centreon Packagist
  • Critical 9.8
    CVE-2018-19281

    Centreon allows SNMP trap SQL Injection

    Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.

    centreon/centreon Packagist
  • Medium 6.1
    CVE-2018-19280

    Centreon XSS Vulnerability

    Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.

    centreon/centreon Packagist
  • High 8.8
    CVE-2018-19271

    Centreon SQL Injection

    Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.

    centreon/centreon Packagist
  • Critical 9.8
    CVE-2018-11587

    Centreon RCE Vulnerability

    There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.

    centreon/centreon Packagist
  • Medium 5.4
    CVE-2015-7672

    Centreon Cross-site Scripting Vulnerability

    Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).

    centreon/centreon Packagist
  • High 8.5
    CVE-2015-1561 Public exploit

    Centreon Command Injection

    The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute …

    centreon/centreon Packagist