Page 15 of 91 results (0.001 seconds)

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2020-8497

https://notcve.org/view.php?id=CVE-2020-8497

In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. En Artica Pandora FMS versiones hasta 7.42, un atacante no autenticado puede leer el historial de chat. El archivo está en formato JSON y contiene nombres de usuario, los ID de usuario, mensajes privados y marcas de tiempo. • https://k4m1ll0.com/cve-2020-8497.html • CWE-306: Missing Authentication for Critical Function •

CVSS: 7.2EPSS: 73%CPEs: 1EXPL: 4

CVE-2020-5844 – Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)

https://notcve.org/view.php?id=CVE-2020-5844

index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020. index.php?sec=godmode/extensions&sec2=extensions/files_repo en Pandora FMS versión v7.0 NG, permite a los administradores autenticados cargar scripts PHP maliciosos y ejecutarlos por medio de la decodificación base64 de la ubicación de archivo. Esto afecta a la versión v7.0NG.742_FIX_PERL2020. • https://www.exploit-db.com/exploits/50961 https://github.com/TheCyberGeek/CVE-2020-5844 https://github.com/UNICORDev/exploit-CVE-2020-5844 http://packetstormsecurity.com/files/167503/Pandora-FMS-7.0NG.742-Remote-Code-Execution.html https://pandorafms.com • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1

CVE-2020-8500

https://notcve.org/view.php?id=CVE-2020-8500

In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality ** EN DISPUTA ** En Artica Pandora FMS 7.42, los usuarios de Web Admin pueden ejecutar código arbitrario cargando un archivo .php a través del componente Updater o Extension. NOTA: El proveedor informa que esta es la funcionalidad prevista. • https://k4m1ll0.com/cve-2020-8500.html https://pandorafms.com/downloads/extension-uploader-feature-explained.mp4 • CWE-434: Unrestricted Upload of File with Dangerous Type •

CVSS: 9.0EPSS: 10%CPEs: 1EXPL: 4

CVE-2020-8947 – PANDORAFMS 7.0 - Authenticated Remote Code Execution

https://notcve.org/view.php?id=CVE-2020-8947

functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224. El archivo functions_netflow.php en Artica Pandora FMS versión 7.0, permite a atacantes remotos ejecutar comandos arbitrarios de Sistema Operativo por medio de metacaracteres de shell en el parámetro ip_dst, dst_port, o src_port de index.php?operation/netflow/nf_live_view, una vulnerabilidad diferente de CVE-2019-20224. Pandora FMS version 7.0 suffers from an authenticated remote code execution vulnerability. • https://www.exploit-db.com/exploits/48064 http://packetstormsecurity.com/files/156326/Pandora-FMS-7.0-Authenticated-Remote-Code-Execution.html https://engindemirbilek.github.io/pandorafms-rce https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/pandorafms-rce.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1

CVE-2019-19968

https://notcve.org/view.php?id=CVE-2019-19968

PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content. PandoraFMS versión 742, sufre de múltiples vulnerabilidades de tipo XSS, afectando a los componentes Agent Management, Report Builder, y Graph Builder. Un usuario autenticado puede inyectar contenido peligroso en un almacén de datos que luego es leído e incluido en un contenido dinámico. • https://k4m1ll0.com/cve-2019-19968.html https://pandorafms.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •