Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list
34added in the last 30 days
344new WordPress flaws this week
390,080entries in the database

139 results · page 3 of 3

  • Nov 26, 2019Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.CVE-2019-16195 · Other software · Centreon · reported by MITREMedium 6.1

    Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 21, 2019Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gainCVE-2019-16406 · Other software · Centreon · reported by MITREHigh 7.8

    Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gain privileges via a Trojan horse Centreon-autodisco executable file that is launched by cron.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 21, 2019Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can mCVE-2019-16405 · Other software · Centreon · reported by MITREHigh 7.2

    Centreon Web before 2.8.30, 18.10.x before 18.10.8, 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 13, 2019Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > DiscoCVE-2019-17501 · Other software · Centreon · reported by MITREHigh 8.8

    Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019The token generator in index.php in Centreon Web before 2.8.27 is predictable.CVE-2019-17105 · Other software · Centreon · reported by MITREMedium 5.3

    The token generator in index.php in Centreon Web before 2.8.27 is predictable.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.CVE-2018-21024 · Other software · Centreon · reported by MITRECritical 9.8

    licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user.CVE-2019-17108 · Other software · Centreon · reported by MITREMedium 6.1

    Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter.CVE-2019-17107 · Other software · Centreon · reported by MITREHigh 8.8

    minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this, but that is incorrect.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.CVE-2019-17106 · Other software · Centreon · reported by MITREMedium 6.5

    In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.CVE-2019-17104 · Other software · Centreon · reported by MITREHigh 7.5

    In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.

    Product
    Centreon VM
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.CVE-2018-21025 · Other software · Centreon · reported by MITRECritical 9.8

    In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.

    Product
    Centreon VM
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.CVE-2018-21023 · Other software · Centreon · reported by MITREHigh 8.8

    getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parameter.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.CVE-2018-21022 · Other software · Centreon · reported by MITREHigh 8.8

    makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parameter.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.CVE-2018-21021 · Other software · Centreon · reported by MITREHigh 8.8

    img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 8, 2019In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisCVE-2018-21020 · Other software · Centreon · reported by MITREHigh 7.5

    In very rare cases, a PHP type juggling vulnerability in centreonAuth.class.php in Centreon Web before 2.8.27 allows attackers to bypass authentication mechanisms in place.

    Product
    Centreon Web
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 25, 2019SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.phCVE-2019-16194 · Other software · Centreon · reported by MITRECritical 9.8

    SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 1, 2019Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "iCVE-2019-13024 · Other software · Centreon · reported by MITREHigh 8.8

    Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 16, 2018Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.CVE-2018-19312 · Other software · Centreon · reported by MITREHigh 8.8

    Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 16, 2018Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > SCVE-2018-19311 · Other software · Centreon · reported by MITREMedium 5.4

    Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 14, 2018Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.CVE-2018-19281 · Other software · Centreon · reported by MITRECritical 9.8

    Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 14, 2018Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.CVE-2018-19280 · Other software · Centreon · reported by MITREMedium 6.1

    Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 14, 2018Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.CVE-2018-19271 · Other software · Centreon · reported by MITREHigh 8.8

    Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 25, 2018Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameterCVE-2018-11589 · Other software · Centreon · reported by MITRECritical 9.8

    Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id parameter in GetXmlHost.php, the chartId parameter in ExportCSVServiceData.php, the searchCurve parameter in listComponentTemplates.php, or the host_id parameter in makeXML_ListMetrics.php.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 25, 2018Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in sCVE-2018-11588 · Other software · Centreon · reported by MITREMedium 5.4

    Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in stored XSS. This is related to www/include/core/menu/menu.php and www/include/configuration/configObject/command/formArguments.php.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jun 25, 2018There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.CVE-2018-11587 · Other software · Centreon · reported by MITRECritical 9.8

    There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Sep 7, 2017Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).CVE-2015-7672 · Other software · Centreon · reported by MITREMedium 5.4

    Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 14, 2015The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in CentreonCVE-2015-1561 · Other software · Centreon · reported by MITREMedium 6.5

    The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ns_id parameter.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Jul 14, 2015SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in CCVE-2015-1560 · Other software · Centreon · reported by MITREHigh 7.5

    SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 22, 2014displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commandCVE-2014-3829 · Other software · Merethis · reported by MITREHigh 10

    displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Oct 22, 2014Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbiCVE-2014-3828 · Other software · Merethis · reported by MITREHigh 10

    Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 19, 2012SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 (fixed in Centreon web 2.6.0) allows remote authenticated users to execute arbitrarCVE-2012-5967 · Other software · Centreon · reported by cret@cert.orgMedium 6.5

    SQL injection vulnerability in menuXML.php in Centreon 2.3.3 through 2.3.9-4 (fixed in Centreon web 2.6.0) allows remote authenticated users to execute arbitrary SQL commands via the menu parameter.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2011www/include/configuration/nconfigObject/contact/DB-Func.php in Merethis Centreon before 2.3.2 does not use a salt during calculation of a password hash, which mCVE-2011-4432 · Other software · Merethis · reported by MITREMedium 5

    www/include/configuration/nconfigObject/contact/DB-Func.php in Merethis Centreon before 2.3.2 does not use a salt during calculation of a password hash, which makes it easier for context-dependent attackers to determine cleartext passwords via a rainbow-table approach.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Nov 9, 2011Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary commands via a ..CVE-2011-4431 · Other software · Merethis · reported by MITREMedium 6.5

    Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary commands via a .. (dot dot) in the command_name parameter.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Apr 7, 2010SQL injection vulnerability in main.php in Centreon 2.1.5 allows remote attackers to execute arbitrary SQL commands via the host_id parameter.CVE-2010-1301 · Other software · Merethis · reported by MITREHigh 7.5

    SQL injection vulnerability in main.php in Centreon 2.1.5 allows remote attackers to execute arbitrary SQL commands via the host_id parameter.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 21, 2009Multiple unspecified vulnerabilities in Centreon before 2.1.4 have unknown impact and attack vectors in the (1) ping tool, (2) traceroute tool, and (3) ldap impCVE-2009-4368 · Other software · Merethis · reported by MITREHigh 10

    Multiple unspecified vulnerabilities in Centreon before 2.1.4 have unknown impact and attack vectors in the (1) ping tool, (2) traceroute tool, and (3) ldap import, possibly related to improper authentication.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 5, 2008Multiple cross-site scripting (XSS) vulnerabilities in include/common/javascript/color_picker.php in Centreon 1.4.2.3 and earlier allow remote attackers to injeCVE-2008-1179 · Other software · Centreon · reported by MITREMedium 4.3

    Multiple cross-site scripting (XSS) vulnerabilities in include/common/javascript/color_picker.php in Centreon 1.4.2.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) name and (2) title parameters. NOTE: some of these details are obtained from third party information.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 5, 2008Directory traversal vulnerability in include/doc/index.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a ..CVE-2008-1178 · Other software · Centreon · reported by MITREMedium 4.3

    Directory traversal vulnerability in include/doc/index.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter, a different vector than CVE-2008-1119.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Mar 3, 2008Directory traversal vulnerability in include/doc/get_image.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a ..CVE-2008-1119 · Other software · Centreon · reported by MITREMedium 5

    Directory traversal vulnerability in include/doc/get_image.php in Centreon 1.4.2.3 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.
  • Dec 20, 2007Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code via a URL in the fileOCVE-2007-6485 · Other software · Centreon · reported by MITREHigh 7.5

    Multiple PHP remote file inclusion vulnerabilities in Centreon 1.4.1 (aka Oreon 1.4) allow remote attackers to execute arbitrary PHP code via a URL in the fileOreonConf parameter to (1) MakeXML.php or (2) MakeXML4statusCounter.php in include/monitoring/engine/.

    Product
    Centreon
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.