CVSS: 5.3EPSS: 27%CPEs: 1EXPL: 1CVE-2020-8497
https://notcve.org/view.php?id=CVE-2020-8497
23 Mar 2020 — In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. En Artica Pandora FMS versiones hasta 7.42, un atacante no autenticado puede leer el historial de chat. El archivo está en formato JSON y contiene nombres de usuario, los ID de usuario, mensajes privados y marcas de tiempo. • https://k4m1ll0.com/cve-2020-8497.html • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.2EPSS: 79%CPEs: 1EXPL: 5CVE-2020-5844 – Pandora FMS v7.0NG.742 - Remote Code Execution (RCE) (Authenticated)
https://notcve.org/view.php?id=CVE-2020-5844
16 Mar 2020 — index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020. index.php?sec=godmode/extensions&sec2=extensions/files_repo en Pandora FMS versión v7.0 NG, permite a los administradores autenticados cargar scripts PHP maliciosos y ejecutarlos por medio de la decodificación base64 de la ubicación de archivo. Esto afecta a ... • https://packetstorm.news/files/id/167503 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2020-8500
https://notcve.org/view.php?id=CVE-2020-8500
02 Mar 2020 — In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality ** EN DISPUTA ** En Artica Pandora FMS 7.42, los usuarios de Web Admin pueden ejecutar código arbitrario cargando un archivo .php a través del componente Updater o Extension. NOTA: El proveedor informa que esta es la funcionalidad prevista. • https://k4m1ll0.com/cve-2020-8500.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 21%CPEs: 1EXPL: 5CVE-2020-8947 – PANDORAFMS 7.0 - Authenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-8947
12 Feb 2020 — functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224. El archivo functions_netflow.php en Artica Pandora FMS versión 7.0, permite a atacantes remotos ejecutar comandos arbitrarios de Sistema Operativo por medio de metacaracteres de shell en el parámetro ip_dst, dst_port, o src_port de index.php?oper... • https://packetstorm.news/files/id/156326 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19968
https://notcve.org/view.php?id=CVE-2019-19968
04 Feb 2020 — PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content. PandoraFMS versión 742, sufre de múltiples vulnerabilidades de tipo XSS, afectando a los componentes Agent Management, Report Builder, y Graph Builder. Un usuario autenticado puede inyectar contenido peligroso en un almacén de datos que luego es leído e i... • https://k4m1ll0.com/cve-2019-19968.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 4%CPEs: 1EXPL: 1CVE-2019-20050
https://notcve.org/view.php?id=CVE-2019-20050
30 Jan 2020 — Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a new folder with a "tricky" name in the filemanager. The exploit works when the php-fileinfo extension is disabled on the host system. The attacker must include shell metacharacters in the content type. Pandora FMS anterior o igual a la versión 7.42, sufre de una vulnerabilidad de ejecución de código remota. • https://k4m1ll0.com/cve-2019-20050.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 86%CPEs: 1EXPL: 6CVE-2019-20224 – Pandora 7.0NG Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-20224
09 Jan 2020 — netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742. netflow_get_stats en functions_netflow.php en Pandora FMS 7.0NG permite a los usuarios identificados remotos ejecutar comandos arbitrarios del sistema operativo a través de metacaracteres de shell en el parámetro ip_src en ... • https://packetstorm.news/files/id/155897 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 0CVE-2019-19681
https://notcve.org/view.php?id=CVE-2019-19681
26 Dec 2019 — Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defi... • https://k4m1ll0.com/cve-2019-19681.html • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-13035
https://notcve.org/view.php?id=CVE-2019-13035
29 Jun 2019 — Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, the Apache service httpd.exe will try to execute cmd.exe from C:\PandoraFMS (the current directory) as NT AUTHORITY\SYSTEM upon web requests to the portal. This will effectively allow non-privileged users to escalate privileges to NT AUTHORITY\SYSTEM. Artica Pandora FMS versión 7.0 NG anterior a 735, sufre de una... • https://github.com/active-labs/Advisories/blob/master/2019/ACTIVE-2019-008.md •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-11221
https://notcve.org/view.php?id=CVE-2018-11221
15 Jun 2018 — Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system. Subida de archivos no fiables sin autenticación en Artica Pandora FMS hasta la versión 7.23 permite que un atacante suba un plugin arbitrario mediante include/ajax/update_manager.ajax en el sistema de actualización. • https://blog.hackercat.ninja/post/pandoras_box • CWE-434: Unrestricted Upload of File with Dangerous Type •