CVSS: 9.0EPSS: 90%CPEs: 1EXPL: 1CVE-2020-13855
https://notcve.org/view.php?id=CVE-2020-13855
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature. Artica Pandora FMS versión 7.44, permite una carga de archivos arbitraria (lo que conlleva a una ejecución de comandos remota) por medio de la funcionalidad File Repository Manager • https://www.coresecurity.com/advisories https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-13850
https://notcve.org/view.php?id=CVE-2020-13850
Artica Pandora FMS 7.44 has inadequate access controls on a web folder. Artica Pandora FMS versión 7.44, posee controles de acceso inadecuados en una carpeta web • https://www.coresecurity.com/advisories https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities • CWE-425: Direct Request ('Forced Browsing') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2020-8511
https://notcve.org/view.php?id=CVE-2020-8511
In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue than CVE-2020-7935 and CVE-2020-8500. En Artica Pandora FMS versiones hasta 7.42, usuarios de Web Admin pueden ejecutar código arbitrario cargando un archivo .php por medio del componente File Repository, un problema diferente de CVE-2020-7935 y CVE-2020-8500. • https://k4m1ll0.com/cve-2020-8511.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2020-7935
https://notcve.org/view.php?id=CVE-2020-7935
Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File Manager. An attacker can create a (or use an existing) directory that is externally accessible to store PHP files. The filename and the exact path is known by the attacker, so it is possible to execute PHP code in the context of the application. The vulnerability is exploitable only with Administrator access. Artica Pandora FMS versiones hasta 7.42, es vulnerable a una ejecución de código PHP remota debido a un problema de Carga Sin Restricciones de un Archivo Con un Tipo Peligroso en el File Manager. • https://k4m1ll0.com/cve-2020-7935.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2020-8497
https://notcve.org/view.php?id=CVE-2020-8497
In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. En Artica Pandora FMS versiones hasta 7.42, un atacante no autenticado puede leer el historial de chat. El archivo está en formato JSON y contiene nombres de usuario, los ID de usuario, mensajes privados y marcas de tiempo. • https://k4m1ll0.com/cve-2020-8497.html • CWE-306: Missing Authentication for Critical Function •