CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15935
https://notcve.org/view.php?id=CVE-2017-15935
Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file. Artica Pandora FMS 7.0 es vulnerable a la ejecución remota de código PHP mediante la función manager files. Esto solo es explotable por administradores que suban un archivo PHP. • https://medium.com/stolabs/security-issue-on-pandora-fms-enterprise-be630059a72d • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15937
https://notcve.org/view.php?id=CVE-2017-15937
Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that general OS information is leaked (e.g., a /var/www pathname typically means Linux or UNIX). Artica Pandora FMS 7.0 fuga un nombre completo de ruta de instalación mediante datos GET cuando se intercepta la llamada a la gráfica de la página principal. Esto también implica la fuga de la información general del sistema operativo (por ejemplo, un nombre de ruta /var/www pathname suele indicar que es Linux o UNIX). • https://medium.com/stolabs/security-issue-on-pandora-fms-enterprise-be630059a72d • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-15934
https://notcve.org/view.php?id=CVE-2017-15934
Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter. Artica Pandora FMS 7.0 es vulnerable a Cross-Site Scripting (XSS) persistente en el parámetro map name. • https://medium.com/stolabs/security-issue-on-pandora-fms-enterprise-be630059a72d • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 2CVE-2010-4282 – Pandora Fms 3.1 - Directory Traversal / Local File Inclusion
https://notcve.org/view.php?id=CVE-2010-4282
Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php. Múltiples vulnerabilidades de salto de directorio en FMS anterior a v3.1.1 permite a atacantes remotos incluir y ejecutar ficheros locales de su elección mediante (1) el parámetro page para ajax.php o (2) el parámetro id para general/pandora_help.php, y permite a atacantes remotos incluir, ejecutar, crear, modificar, o borrar ficheros locales de su elección mediante (3) el parámetro layout para operation/agentes/networkmap.php. Pandora FMS versions 3.1 and below suffer from authentication bypass, os command injection, remote SQL injection, remote file inclusion and path traversal vulnerabilities. • https://www.exploit-db.com/exploits/15643 http://osvdb.org/69543 http://osvdb.org/69544 http://osvdb.org/69545 http://seclists.org/fulldisclosure/2010/Nov/326 http://secunia.com/advisories/42347 http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download http://www.exploit-db.com/exploits/15643 http://www.securityfocus.com/archive/1/514939/100/0/threaded http://www.secur • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 3%CPEs: 16EXPL: 3CVE-2010-4278 – Pandora Fms 3.1 - OS Command Injection
https://notcve.org/view.php?id=CVE-2010-4278
operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php. operación/agentes/networkmap.php en Pandora FMS anterior a v3.1.1 permite a usuarios remotos autenticados ejecutar código arbitrario a través de meta-caracteres de shell en el parámetro layout en una acción operation/agentes/networkmap para index.php Pandora FMS versions 3.1 and below suffer from authentication bypass, os command injection, remote SQL injection, remote file inclusion and path traversal vulnerabilities. • https://www.exploit-db.com/exploits/15640 http://osvdb.org/69550 http://seclists.org/fulldisclosure/2010/Nov/326 http://secunia.com/advisories/42347 http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download http://www.exploit-db.com/exploits/15640 http://www.securityfocus.com/archive/1/514939/100/0/threaded http://www.securityfocus.com/bid/45112 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •