packagist/centreon/centreon/CVE-2024-23115.yml

+---
+identifier: "CVE-2024-23115"
+identifiers:
+- "CVE-2024-23115"
+- "GHSA-qjvm-p5vg-437c"
+package_slug: "packagist/centreon/centreon"
+title: "Centreon updateGroups SQL Injection Remote Code Execution Vulnerability"
+description: "Centreon updateGroups SQL Injection Remote Code Execution Vulnerability.
+  This vulnerability allows remote attackers to execute arbitrary code on affected
+  installations of Centreon. Authentication is required to exploit this vulnerability.\n\nThe
+  specific flaw exists within the updateGroups function. The issue results from the
+  lack of proper validation of a user-supplied string before using it to construct
+  SQL queries. An attacker can leverage this vulnerability to execute code in the
+  context of the service account. Was ZDI-CAN-22295."
+date: "2024-04-02"
+pubdate: "2024-04-02"
+affected_range: "<22.10.15"
+fixed_versions:
+- "22.10.15"
+affected_versions: "All versions before 22.10.15"
+not_impacted: "All versions starting from 22.10.15"
+solution: "Upgrade to version 22.10.15 or above."
+urls:
+- "https://nvd.nist.gov/vuln/detail/CVE-2024-23115"
+- "https://github.com/advisories/GHSA-qjvm-p5vg-437c"
+- "https://github.com/centreon/centreon/pull/2464"
+- "https://github.com/centreon/centreon/commit/c6ee0f67544a70524539b26e8ea92209676a5399"
+- "https://github.com/centreon/centreon"
+- "https://www.zerodayinitiative.com/advisories/ZDI-24-117"
+cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+uuid: "17ca16ab-ec9e-4b87-a9dc-9681861a936d"
+cwe_ids:
+- "CWE-89"
+- "CWE-937"
+- "CWE-1035"

packagist/centreon/centreon/CVE-2024-23117.yml

+---
+identifier: "CVE-2024-23117"
+identifiers:
+- "CVE-2024-23117"
+- "GHSA-j8hg-v5qv-9m28"
+package_slug: "packagist/centreon/centreon"
+title: "Centreon updateContactServiceCommands SQL Injection Remote Code Execution
+  Vulnerability"
+description: "Centreon updateContactServiceCommands SQL Injection Remote Code Execution
+  Vulnerability. This vulnerability allows remote attackers to execute arbitrary code
+  on affected installations of Centreon. Authentication is required to exploit this
+  vulnerability.\n\nThe specific flaw exists within the updateContactServiceCommands
+  function. The issue results from the lack of proper validation of a user-supplied
+  string before using it to construct SQL queries. An attacker can leverage this vulnerability
+  to execute code in the context of the service account. Was ZDI-CAN-22297."
+date: "2024-04-02"
+pubdate: "2024-04-02"
+affected_range: "<22.10.15"
+fixed_versions:
+- "22.10.15"
+affected_versions: "All versions before 22.10.15"
+not_impacted: "All versions starting from 22.10.15"
+solution: "Upgrade to version 22.10.15 or above."
+urls:
+- "https://nvd.nist.gov/vuln/detail/CVE-2024-23117"
+- "https://github.com/advisories/GHSA-j8hg-v5qv-9m28"
+- "https://github.com/centreon/centreon/pull/2464"
+- "https://github.com/centreon/centreon/commit/c6ee0f67544a70524539b26e8ea92209676a5399"
+- "https://github.com/centreon/centreon"
+- "https://www.zerodayinitiative.com/advisories/ZDI-24-115"
+cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+uuid: "82edb893-6a7a-42de-b64c-ba10776df4d3"
+cwe_ids:
+- "CWE-89"
+- "CWE-937"
+- "CWE-1035"

packagist/centreon/centreon/CVE-2024-23119.yml

+---
+identifier: "CVE-2024-23119"
+identifiers:
+- "CVE-2024-23119"
+- "GHSA-626r-cj47-p49g"
+package_slug: "packagist/centreon/centreon"
+title: "Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability"
+description: "Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability.
+  This vulnerability allows remote attackers to execute arbitrary code on affected
+  installations of Centreon. Authentication is required to exploit this vulnerability.\n\nThe
+  specific flaw exists within the insertGraphTemplate function. The issue results
+  from the lack of proper validation of a user-supplied string before using it to
+  construct SQL queries. An attacker can leverage this vulnerability to execute code
+  in the context of the service account. Was ZDI-CAN-22339."
+date: "2024-04-02"
+pubdate: "2024-04-02"
+affected_range: "<22.10.15"
+fixed_versions:
+- "22.10.15"
+affected_versions: "All versions before 22.10.15"
+not_impacted: "All versions starting from 22.10.15"
+solution: "Upgrade to version 22.10.15 or above."
+urls:
+- "https://nvd.nist.gov/vuln/detail/CVE-2024-23119"
+- "https://github.com/advisories/GHSA-626r-cj47-p49g"
+- "https://github.com/centreon/centreon/pull/2464"
+- "https://github.com/centreon/centreon/commit/c6ee0f67544a70524539b26e8ea92209676a5399"
+- "https://github.com/centreon/centreon"
+- "https://www.zerodayinitiative.com/advisories/ZDI-24-113"
+cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+uuid: "539d0bd7-0441-43af-b2e3-fa5d926bd707"
+cwe_ids:
+- "CWE-89"
+- "CWE-937"
+- "CWE-1035"

packagist/uvdesk/core-framework/CVE-2024-3137.yml

+---
+identifier: "CVE-2024-3137"
+identifiers:
+- "CVE-2024-3137"
+- "GHSA-57q5-h622-3cpx"
+package_slug: "packagist/uvdesk/core-framework"
+title: "UVDesk Community Helpdesk Improper Privilege Management"
+description: "Improper Privilege Management in uvdesk/community-skeleton"
+date: "2024-04-02"
+pubdate: "2024-04-02"
+affected_range: "<=1.1.1"
+fixed_versions: []
+affected_versions: "All versions up to 1.1.1"
+not_impacted: ""
+solution: "Unfortunately, there is no solution available yet."
+urls:
+- "https://nvd.nist.gov/vuln/detail/CVE-2024-3137"
+- "https://github.com/advisories/GHSA-57q5-h622-3cpx"
+- "https://github.com/uvdesk/core-framework"
+- "https://github.com/uvdesk/core-framework/blob/master/Controller/Thread.php#L44"
+- "https://huntr.com/bounties/faf74783-644c-40cd-aa98-2239e5fafcd1"
+cvss_v3: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"
+uuid: "ba975974-ca0b-4367-b504-14f70833bea5"
+cwe_ids:
+- "CWE-269"
+- "CWE-937"
+- "CWE-1035"