CVE-2019-16406

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Centreon Web 19.04.4 has weak permissions within the OVA (aka VMware virtual machine) and OVF (aka VirtualBox virtual machine) files, allowing attackers to gain privileges via a Trojan horse Centreon-autodisco executable file that is launched by cron.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Nov 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-164077.3JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability.CVE-2019-164095.3In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess CVE-2019-16417.8A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could all CVE-2019-164109.1An issue was discovered in Suricata 4.1.4. By sending multiple fragmented IPv4 packets, the function Defrag4Reassemble in defrag.c tries to CVE-2019-164119.8An issue was discovered in Suricata 4.1.4. By sending multiple IPv4 packets that have invalid IPv4Options, the function IPV4OptValidateTimes CVE-2019-164127.5In goform/setSysTools on Tenda N301 wireless routers, attackers can trigger a device crash via a zero wanMTU value. (Prohibition of this zer CVE-2019-164137.5An issue was discovered in the Linux kernel before 5.0.4. The 9p filesystem did not protect i_size_write() properly, which causes an i_size_CVE-2019-164146.1A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's clear CVE-2019-164165.4HRworks 3.36.9 allows XSS via the purpose of a travel-expense report.CVE-2019-164175.4HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report.CVE-2019-16426.1A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, re CVE-2019-16436.1A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to condu