CVE-2018-19311
Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
- Update to 18.10.0
Published Updated
PatchFirst · Latest vulnerabilities
centreon/centreon vulnerabilities · Page 2
Vulnerabilities published for centreon/centreon in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 27
CVE-2018-19281
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
- Update to 18.10.0
- Update to 2.8.27
Published UpdatedCVE-2018-19280
Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
- Update to 18.10.0
Published UpdatedCVE-2018-19271
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.
- Update to 18.10.0
- Update to 2.8.28
Published UpdatedCVE-2018-11587
There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.
- Update to 2.8.24
Published UpdatedCVE-2015-7672
Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).
- Update to 2.8.27
Published UpdatedCVE-2015-1561
The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ns_id parameter.
- Update to 2.8.28
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.