CVSS: 7.2EPSS: 73%CPEs: 1EXPL: 4CVE-2020-5844 – Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)
https://notcve.org/view.php?id=CVE-2020-5844
index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020. index.php?sec=godmode/extensions&sec2=extensions/files_repo en Pandora FMS versión v7.0 NG, permite a los administradores autenticados cargar scripts PHP maliciosos y ejecutarlos por medio de la decodificación base64 de la ubicación de archivo. Esto afecta a la versión v7.0NG.742_FIX_PERL2020. • https://www.exploit-db.com/exploits/50961 https://github.com/TheCyberGeek/CVE-2020-5844 https://github.com/UNICORDev/exploit-CVE-2020-5844 http://packetstormsecurity.com/files/167503/Pandora-FMS-7.0NG.742-Remote-Code-Execution.html https://pandorafms.com • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2020-8500
https://notcve.org/view.php?id=CVE-2020-8500
In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality ** EN DISPUTA ** En Artica Pandora FMS 7.42, los usuarios de Web Admin pueden ejecutar código arbitrario cargando un archivo .php a través del componente Updater o Extension. NOTA: El proveedor informa que esta es la funcionalidad prevista. • https://k4m1ll0.com/cve-2020-8500.html https://pandorafms.com/downloads/extension-uploader-feature-explained.mp4 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 10%CPEs: 1EXPL: 4CVE-2020-8947 – PANDORAFMS 7.0 - Authenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-8947
functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224. El archivo functions_netflow.php en Artica Pandora FMS versión 7.0, permite a atacantes remotos ejecutar comandos arbitrarios de Sistema Operativo por medio de metacaracteres de shell en el parámetro ip_dst, dst_port, o src_port de index.php?operation/netflow/nf_live_view, una vulnerabilidad diferente de CVE-2019-20224. Pandora FMS version 7.0 suffers from an authenticated remote code execution vulnerability. • https://www.exploit-db.com/exploits/48064 http://packetstormsecurity.com/files/156326/Pandora-FMS-7.0-Authenticated-Remote-Code-Execution.html https://engindemirbilek.github.io/pandorafms-rce https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/pandorafms-rce.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19968
https://notcve.org/view.php?id=CVE-2019-19968
PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content. PandoraFMS versión 742, sufre de múltiples vulnerabilidades de tipo XSS, afectando a los componentes Agent Management, Report Builder, y Graph Builder. Un usuario autenticado puede inyectar contenido peligroso en un almacén de datos que luego es leído e incluido en un contenido dinámico. • https://k4m1ll0.com/cve-2019-19968.html https://pandorafms.com • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-20050
https://notcve.org/view.php?id=CVE-2019-20050
Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a new folder with a "tricky" name in the filemanager. The exploit works when the php-fileinfo extension is disabled on the host system. The attacker must include shell metacharacters in the content type. Pandora FMS anterior o igual a la versión 7.42, sufre de una vulnerabilidad de ejecución de código remota. • https://k4m1ll0.com/cve-2019-20050.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •