Vendor
Centreon
55 known vulnerabilities.
Products
18 results · Clear filters · Feed
-
Medium 6.5
Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure
Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user
-
Medium 5.4
Broken Function Level Authorization — `postcommand.php` allows execution of poller post-restart commands by non-admin users
Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user
-
Medium 6.8
A user with elevated privileges can inject XSS in the DSM Administration’s Extensions configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configuration modules) allows Stored XSS to user with elevated privileges. This issue affects Infra Monitorin…
-
Medium 6.8
A user with elevated privileges can inject XSS in the Hosts configuration parameters page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration form modules) allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: fro…
-
Medium 5.3
Information disclosure on Administration parameters API endpoint
Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly Constrained by ACLs, resulting in Information Disclosure like downtime or acknowledgement configurati…
-
Medium 6.8
A user with elevated privileges can inject XSS in the Administration ACL Menus configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu configuration modules) allows Stored XSS to users with high privileges. This issue affects Infra Mo…
-
Medium 6.8
A user with elevated privileges can inject XSS in the Hostgroups configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration page) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: from…
-
Medium 6.8
A user with elevated privileges can inject XSS in the Notification rules configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Open tickets module) allows Stored XSS by users with elevated privileges.This issue affects Infra Monit…
-
Medium 6.2
A user with elevated privileges can inject XSS in the Services Meta-services configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Services Meta-services modules) allows Stored XSS by users with elevated privileges.This issue affects Infra Monitoring: fr…
-
Medium 6.8
A user with elevated privileges can inject XSS in the Commands Connectors configuration configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Commands Connectors configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Mo…
-
Medium 6.8
A user with elevated privileges can inject XSS in the ACL Action access configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Action access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Moni…
-
Medium 6.8
A user with elevated privileges can inject XSS in the Hosts templates configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts templates configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monito…
-
Medium 6.8
A user with elevated privileges can inject XSS in the ACL Resource Access configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (ACL Resource access configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Mo…
-
Medium 6.8
A user with elevated privileges can inject XSS in the SNMP traps group configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps group configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infra Monit…
-
Medium 6.8
A user with elevated privileges can inject XSS in the SNMP traps manufacturer configuration page
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (SNMP traps manufacturer configuration modules) allows Stored XSS by users with elevated privileges. This issue affects Infr…
-
Medium 6.8
XSS found in the HTTP loader widget
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (HTTP Loader widget modules) allows Stored XSS.This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04…
-
Medium 4.9
ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs.
Improper Handling of Exceptional Conditions vulnerability in Centreon web allows Privilege Escalation. ACL are not correctly taken into account in the display of the "event logs" page. This page requiring, high privileges, will display all available logs. Thi…
-
Medium 6.5
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Centreon. Aut…