Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

167 results · page 3 of 4

Apr 12, 2021Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon: The WordPress login form (wp-loginCVE-2021-24228 · WordPress plugins & themes · reported by WPScanCritical 9.6
The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form (wp-login.php) is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of the error logging logic behind the scene allowed user-controlled input to be reflected on the login page, unsanitized.
Product
Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon
Fixed in
1.7.2
What to do
Update Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon to 1.7.2 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Apr 12, 2021Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon: That could be abused by anyone visiting the siteCVE-2021-24227 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the generation of nonces and cookies.
Product
Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon
Fixed in
1.7.0
What to do
Update Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon to 1.7.0 or newer.
Full record and what to do →NVD record jetpack.com wpscan.com
Feb 15, 2021Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command eCVE-2020-22425 · Other software · Centreon · reported by MITREHigh 8.8
Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command execution.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code610.blogspot.com github.com
May 27, 2020Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbaCVE-2020-13628 · Other software · Centreon · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
Product
Centreon Host-monitoring Widget
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sysdream.com sysdream.com
May 27, 2020Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/indCVE-2020-13627 · Other software · Centreon · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
Product
Centreon Host-monitoring Widget
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sysdream.com sysdream.com
May 27, 2020Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.pCVE-2020-10946 · Other software · Centreon · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
Product
Centreon Host-monitoring Widget
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sysdream.com sysdream.com
May 27, 2020Centreon before 19.10.7 exposes Session IDs in server responses.CVE-2020-10945 · Other software · Centreon · reported by MITREMedium 4.3
Centreon before 19.10.7 exposes Session IDs in server responses.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record sysdream.com sysdream.com
May 21, 2020Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.phpCVE-2020-13252 · Other software · Centreon · reported by MITREHigh 8.8
Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record engindemirbilek.github.io github.com
Apr 6, 2020There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system comproCVE-2019-19699 · Other software · Centreon · reported by MITREHigh 7.2
There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify an executable file executed by root at 22:30 every day. To exploit the vulnerability, someone must have Admin access to the Centreon Web Interface and create a custom main.php?p=60803&type=3 command. The user must then set the Pollers Post-Restart Command to this previously created command via the main.php?p=60901&o=c&server_id=1 URI. This is triggered via an export of the Poller Configuration.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.centreon.com github.com
Mar 19, 2020Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test.CVE-2019-19487 · Other software · Centreon · reported by MITREHigh 8.8
Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Mar 19, 2020Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test.CVE-2019-19486 · Other software · Centreon · reported by MITREMedium 6.5
Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Mar 19, 2020Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended behavior.CVE-2019-19484 · Other software · Centreon · reported by MITREMedium 6.1
Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended behavior.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com medium.com
Mar 5, 2020An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2.CVE-2019-17647 · Other software · Centreon · reported by MITRECritical 9.8
An issue was discovered in Centreon before 2.8.30, 18.10.8, 19.04.5, and 19.10.2. SQL Injection exists via the include/monitoring/status/Hosts/xml/hostXML.php instance parameter.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Mar 5, 2020An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2.CVE-2019-17646 · Other software · Centreon · reported by MITREHigh 7.5
An issue was discovered in Centreon before 18.10.8, 19.04.5, and 19.10.2. It provides sensitive information via an unauthenticated direct request for api/external.php?object=centreon_metric&action=listByService.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Mar 5, 2020An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3.CVE-2019-17645 · Other software · Centreon · reported by MITREHigh 7.5
An issue was discovered in Centreon before 2.8.31, 18.10.9, 19.04.6, and 19.10.3. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/service/refreshMacroAjax.php.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Mar 5, 2020An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2.CVE-2019-17642 · Other software · Centreon · reported by MITREHigh 8.8
An issue was discovered in Centreon before 18.10.8, 19.10.1, and 19.04.2. It allows CSRF with resultant remote command execution via shell metacharacters in a POST to centreon-autodiscovery-server/views/scan/ajax/call.php in the Autodiscovery plugin.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Mar 4, 2020An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2..CVE-2019-17644 · Other software · Centreon · reported by MITREHigh 7.5
An issue was discovered in Centreon before 2.8-30, 18.10-8, 19.04-5, and 19.10-2.. It provides sensitive information via an unauthenticated direct request for include/configuration/configObject/host/refreshMacroAjax.php.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Mar 4, 2020An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2.CVE-2019-17643 · Other software · Centreon · reported by MITREHigh 7.5
An issue was discovered in Centreon before 2.8-30,18.10-8, 19.04-5, and 19.10-2. It provides sensitive information via an unauthenticated direct request for include/monitoring/recurrentDowntime/GetXMLHost4Services.php.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Feb 28, 2020Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internaCVE-2020-9463 · Other software · Centreon · reported by MITREHigh 8.8
Centreon 19.10 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server_ip field in JSON data in an api/internal.php?object=centreon_configuration_remote request.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record code610.blogspot.com code610.blogspot.com
Feb 24, 2020An issue was discovered in Centreon Web through 19.04.3.CVE-2019-15299 · Other software · Centreon · reported by MITREHigh 8.8
An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the contact_autologin_key field in the database becomes blank when it should be NULL. This makes it possible to partially bypass authentication.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Jan 16, 2020Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges.CVE-2019-20327 · Other software · Centreon · reported by MITREHigh 7.8
Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software through 19.10 allow local attackers to gain privileges. (cwrapper_perl is a setuid executable allowing execution of Perl scripts with root privileges.)
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com centreon.com
Nov 27, 2019A problem was found in Centreon Web through 19.04.3.CVE-2019-15300 · Other software · Centreon · reported by MITREHigh 8.8
A problem was found in Centreon Web through 19.04.3. An authenticated SQL injection is present in the page include/Administration/parameters/ldap/xml/ldap_host.php. The arId parameter is not properly filtered before being passed to the SQL query.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Nov 27, 2019A problem was found in Centreon Web through 19.04.3.CVE-2019-15298 · Other software · Centreon · reported by MITREHigh 8.8
A problem was found in Centreon Web through 19.04.3. An authenticated command injection is present in the page include/configuration/configObject/traps-mibs/formMibs.php. This page is called from the Centreon administration interface. This is the mibs management feature that contains a file filing form. At the time of submission of a file, the mnftr parameter is sent to the page and is not filtered properly. This allows one to inject Linux commands directly.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com github.com
Nov 26, 2019Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.CVE-2019-16195 · Other software · Centreon · reported by MITREMedium 6.1
Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Nov 21, 2019Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gainCVE-2019-16406 · Other software · Centreon · reported by MITREHigh 7.8
Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gain privileges via a Trojan horse Centreon-autodisco executable file that is launched by cron.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Nov 21, 2019Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can mCVE-2019-16405 · Other software · Centreon · reported by MITREHigh 7.2
Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com documentation.centreon.com
Oct 13, 2019Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > DiscoCVE-2019-17501 · Other software · Centreon · reported by MITREHigh 8.8
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Oct 9, 2019Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of the login page throCVE-2019-17128 · Other software · Netreo · reported by MITREHigh 7.5
Netreo OmniCenter through 12.1.1 allows unauthenticated SQL Injection (Boolean Based Blind) in the redirect parameters and parameter name of the login page through a GET request. The injection allows an attacker to read sensitive information from the database used by the application.
Product
Omnicenter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com netreo.com
Oct 8, 2019The token generator in index.php in Centreon Web before 2.8.27 is predictable.CVE-2019-17105 · Other software · Centreon · reported by MITREMedium 5.3
The token generator in index.php in Centreon Web before 2.8.27 is predictable.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.CVE-2018-21024 · Other software · Centreon · reported by MITRECritical 9.8
licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user.CVE-2019-17108 · Other software · Centreon · reported by MITREMedium 6.1
Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter.CVE-2019-17107 · Other software · Centreon · reported by MITREHigh 8.8
minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.CVE-2019-17106 · Other software · Centreon · reported by MITREMedium 6.5
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.CVE-2019-17104 · Other software · Centreon · reported by MITREHigh 7.5
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
Product
Centreon VM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.CVE-2018-21025 · Other software · Centreon · reported by MITRECritical 9.8
In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.
Product
Centreon VM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.CVE-2018-21023 · Other software · Centreon · reported by MITREHigh 8.8
getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.CVE-2018-21022 · Other software · Centreon · reported by MITREHigh 8.8
makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.CVE-2018-21021 · Other software · Centreon · reported by MITREHigh 8.8
img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Oct 8, 2019In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisCVE-2018-21020 · Other software · Centreon · reported by MITREHigh 7.5
In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place.
Product
Centreon Web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Sep 25, 2019SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.phCVE-2019-16194 · Other software · Centreon · reported by MITRECritical 9.8
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Aug 22, 2019The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.CVE-2018-20984 · WordPress plugins & themes · reported by MITRECritical 9.8
The patreon-connect plugin before 1.2.2 for WordPress has Object Injection.
Product
patreon-connect
Fixed in
1.2.2
What to do
Update patreon-connect to 1.2.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jul 1, 2019Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "iCVE-2019-13024 · Other software · Centreon · reported by MITREHigh 8.8
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com documentation.centreon.com
Nov 16, 2018Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.CVE-2018-19312 · Other software · Centreon · reported by MITREHigh 8.8
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record roothc.com.br documentation.centreon.com
Nov 16, 2018Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > SCVE-2018-19311 · Other software · Centreon · reported by MITREMedium 5.4
Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record roothc.com.br documentation.centreon.com
Nov 14, 2018Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.CVE-2018-19281 · Other software · Centreon · reported by MITRECritical 9.8
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com documentation.centreon.com
Nov 14, 2018Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.CVE-2018-19280 · Other software · Centreon · reported by MITREMedium 6.1
Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com github.com
Nov 14, 2018Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.CVE-2018-19271 · Other software · Centreon · reported by MITREHigh 8.8
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rootlabs.com.br documentation.centreon.com
Jun 25, 2018Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameterCVE-2018-11589 · Other software · Centreon · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com github.com
Jun 25, 2018Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in sCVE-2018-11588 · Other software · Centreon · reported by MITREMedium 5.4
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com github.com
Jun 25, 2018There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.CVE-2018-11587 · Other software · Centreon · reported by MITRECritical 9.8
There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.
Product
Centreon
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.centreon.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.