CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41814 – XSS Vulnerability Messages
https://notcve.org/view.php?id=CVE-2023-41814
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications. This issue affects Pandora FMS: from 700 through 774. La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en Pandora FMS on all permite Cross-Site Scripting (XSS). A través de un paylaod HTML (etiqueta iframe) es posible realizar ataques XSS cuando el usuario que recibe los mensajes abre sus notificaciones. • https://pandorafms.com/en/security/common-vulnerabilities-and-exposures • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41813 – User notification settings edition
https://notcve.org/view.php?id=CVE-2023-41813
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Allows you to edit the Web Console user notification options. This issue affects Pandora FMS: from 700 through 774. La vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web ('Cross-site Scripting') en Pandora FMS on all permite Cross-Site Scripting (XSS). Le permite editar las opciones de notificación del usuario de la consola web. • https://pandorafms.com/en/security/common-vulnerabilities-and-exposures • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41812 – Uploading executables via the file manager
https://notcve.org/view.php?id=CVE-2023-41812
Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allowed PHP executable files to be uploaded through the file manager. This issue affects Pandora FMS: from 700 through 773. La carga sin restricciones de archivos con vulnerabilidad de tipo peligroso en Pandora FMS permite acceder a funcionalidades no correctamente restringidas por ACL. Esta vulnerabilidad permitía cargar archivos ejecutables PHP a través del administrador de archivos. • https://pandorafms.com/en/security/common-vulnerabilities-and-exposures • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41811 – Stored XSS Via Site News Page
https://notcve.org/view.php?id=CVE-2023-41811
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the news section of the web console. This issue affects Pandora FMS: from 700 through 773. La vulnerabilidad de Neutralización inadecuada de la entrada durante la generación de páginas web ('Cross-site Scripting') en Pandora FMS permite en todos los casos Cross-Site Scripting (XSS). Esta vulnerabilidad permitía ejecutar código Javascript en la sección de noticias de la consola web. • https://pandorafms.com/en/security/common-vulnerabilities-and-exposures • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41810 – Stored XSS Via Dashboard Panel
https://notcve.org/view.php?id=CVE-2023-41810
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in some Widgets' text box. This issue affects Pandora FMS: from 700 through 773. La vulnerabilidad de Neutralización inadecuada de la entrada durante la generación de páginas web ('Cross-site Scripting') en Pandora FMS permite en todos los casos Cross-Site Scripting (XSS). Esta vulnerabilidad permitía ejecutar código Javascript en el cuadro de texto de algunos Widgets. • https://pandorafms.com/en/security/common-vulnerabilities-and-exposures • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •