CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-11222
https://notcve.org/view.php?id=CVE-2018-11222
15 Jun 2018 — Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint. Inclusión de archivos locales en Artica Pandora FMS hasta la versión 7.23 permite que un atacante llame a cualquier archivo php mediante el endpoint de ajax /pandora_console/ajax.php. • https://blog.hackercat.ninja/post/pandoras_box • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15934
https://notcve.org/view.php?id=CVE-2017-15934
27 Oct 2017 — Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter. Artica Pandora FMS 7.0 es vulnerable a Cross-Site Scripting (XSS) persistente en el parámetro map name. • https://medium.com/stolabs/security-issue-on-pandora-fms-enterprise-be630059a72d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15935
https://notcve.org/view.php?id=CVE-2017-15935
27 Oct 2017 — Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file. Artica Pandora FMS 7.0 es vulnerable a la ejecución remota de código PHP mediante la función manager files. Esto solo es explotable por administradores que suban un archivo PHP. • https://medium.com/stolabs/security-issue-on-pandora-fms-enterprise-be630059a72d • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15936
https://notcve.org/view.php?id=CVE-2017-15936
27 Oct 2017 — In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed. En Artica Pandora FMS 7.0, un atacante con permiso de escritura puede crear un agente con una carga útil XSS. Cuando un usuario entre en la página de definiciones del agente, el script se ejecutará. • https://medium.com/stolabs/security-issue-on-pandora-fms-enterprise-be630059a72d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15937
https://notcve.org/view.php?id=CVE-2017-15937
27 Oct 2017 — Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that general OS information is leaked (e.g., a /var/www pathname typically means Linux or UNIX). Artica Pandora FMS 7.0 fuga un nombre completo de ruta de instalación mediante datos GET cuando se intercepta la llamada a la gráfica de la página principal. Esto también implica la fuga de la información general del sistema operativo (por ejemplo, un nombre de rut... • https://medium.com/stolabs/security-issue-on-pandora-fms-enterprise-be630059a72d • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 87%CPEs: 16EXPL: 5CVE-2010-4279 – Pandora FMS 3.1 - Authentication Bypass / Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2010-4279
02 Dec 2010 — The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter. La configuración por defecto de Pandora FMS v3.1 y anteriores especifica una cadena vacía para el campo loginhash_pwd, permitiendo a atacantes remotos evitar la autenticación mediante el e... • https://packetstorm.news/files/id/129830 • CWE-287: Improper Authentication •
CVSS: 9.0EPSS: 10%CPEs: 16EXPL: 3CVE-2010-4278 – Pandora Fms 3.1 - OS Command Injection
https://notcve.org/view.php?id=CVE-2010-4278
02 Dec 2010 — operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php. operación/agentes/networkmap.php en Pandora FMS anterior a v3.1.1 permite a usuarios remotos autenticados ejecutar código arbitrario a través de meta-caracteres de shell en el parámetro layout en una acción operation/agentes/networkmap para index.php • https://www.exploit-db.com/exploits/15640 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 8%CPEs: 16EXPL: 4CVE-2010-4280 – Pandora Fms 3.1 - Blind SQL Injection
https://notcve.org/view.php?id=CVE-2010-4280
02 Dec 2010 — Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group parameter in an operation/agentes/ver_agente action to ajax.php or (2) the group_id parameter in an operation/agentes/estado_agente action to index.php, related to operation/agentes/estado_agente.php. Múltiples vulnerabilidades de inyección SQL en Pandora FMS anterior a v3.1.1, permite a usuarios autenticados ejecutar comandos SQL de su elección a través ... • https://www.exploit-db.com/exploits/15642 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 7%CPEs: 16EXPL: 3CVE-2010-4281 – Pandora Fms 3.1 - Directory Traversal / Local File Inclusion
https://notcve.org/view.php?id=CVE-2010-4281
02 Dec 2010 — Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : (colon) character. Vulnerabilidad de lista negra incompleta en la función safe_url_extraclean en ajax.php en Pandora FMS anterior a v3.1.1 permite a atacantes remotos ejecutar código PHP arbitrario mediante un parámetro de página que contiene una ruta d... • https://www.exploit-db.com/exploits/15643 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 3%CPEs: 16EXPL: 2CVE-2010-4282 – Pandora Fms 3.1 - Directory Traversal / Local File Inclusion
https://notcve.org/view.php?id=CVE-2010-4282
02 Dec 2010 — Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php. Múltiples vulnerabilidades de salto de directorio en FMS anterior a v3.1.1 permite a atacantes remotos incluir y e... • https://www.exploit-db.com/exploits/15643 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •