← Back

Centreon

centreon

124 CVEs • 11 products

Products (11)

Click to collapse
Toggle
Centreon
centreon
59 CVEs
Centreon Web
centreon_web
56 CVEs
Centreon Host Monitoring Widget
centreon_host-monitoring_widget
3 CVEs
Centreon Tactical Overview Widget
centreon_tactical-overview_widget
3 CVEs
Centreon Service Monitoring Widget
centreon_service-monitoring_widget
3 CVEs
Open Tickets
open_tickets
3 CVEs
Centreon Vm
centreon_vm
2 CVEs
Awie
awie
2 CVEs
Widget Host Monitoring
widget-host-monitoring
1 CVE
Dynamic Service Management
dynamic_service_management
1 CVE
Web
web
1 CVE

CVEs (124)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-17106
1Centreon
1Centreon Web
Jun 17, 2026
Oct 8, 2019
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
CVE-2019-17104
1Centreon
1Centreon Vm
Jun 17, 2026
Oct 8, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
CVE-2018-21025
1Centreon
1Centreon Vm
Nov 21, 2024
Oct 8, 2019
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.
CVE-2018-21023
1Centreon
1Centreon Web
Nov 21, 2024
Oct 8, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.
CVE-2018-21022
1Centreon
1Centreon Web
Nov 21, 2024
Oct 8, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.
CVE-2018-21021
1Centreon
1Centreon Web
Nov 21, 2024
Oct 8, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.
CVE-2018-21020
1Centreon
1Centreon Web
Nov 21, 2024
Oct 8, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place.
CVE-2019-16194
1Centreon
1Centreon
Jun 17, 2026
Sep 25, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.
CVE-2019-13024
1Centreon
1Centreon
Jun 17, 2026
Jul 1, 2019
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to in...Show more
Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).Show less
CVE-2018-19312
1Centreon
1Centreon
Nov 21, 2024
Nov 16, 2018
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
CVE-2018-19311
1Centreon
1Centreon
Nov 21, 2024
Nov 16, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
CVE-2018-19281
1Centreon
1Centreon
Nov 21, 2024
Nov 14, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
CVE-2018-19280
1Centreon
1Centreon
Nov 21, 2024
Nov 14, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
CVE-2018-19271
1Centreon
1Centreon
Nov 21, 2024
Nov 14, 2018
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.
CVE-2018-11589
1Centreon
2Centreon
Centreon Web
Nov 21, 2024
Jun 25, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServic...Show more
Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.Show less
CVE-2018-11588
1Centreon
2Centreon
Centreon Web
Nov 21, 2024
Jun 25, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php...Show more
Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php.Show less
CVE-2018-11587
1Centreon
2Centreon
Centreon Web
Nov 21, 2024
Jun 25, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.
CVE-2015-7672
1Centreon
1Centreon
May 13, 2026
Sep 7, 2017
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).
CVE-2015-1561
1Centreon
1Centreon
May 6, 2026
Jul 14, 2015
N/A· v4
N/A· v3
6.5 MEDIUM· v2
The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows...Show more
The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ns_id parameter.Show less
CVE-2015-1560
1Centreon
1Centreon
May 6, 2026
Jul 14, 2015
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitr...Show more
SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.Show less