Latest pandorafms pandora fms Vulnerabilities

● CVE-2023-44089
XSS in Visual Console
Pandorafms Pandora Fms>=700<=774
● CVE-2023-44088
SQL Injection in Visual Console
Pandorafms Pandora Fms>=700<=774
● CVE-2023-41815
XSS in File manager
Pandorafms Pandora Fms>=700<=774
● CVE-2023-41814
XSS Vulnerability Messages
Pandorafms Pandora Fms>=700<=774
● CVE-2023-41813
User notification settings edition
Pandorafms Pandora Fms>=700<=774
● CVE-2023-24518
A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This i...
Pandorafms Pandora Fms<=767
● CVE-2023-0828
Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora...
Pandorafms Pandora Fms<=767
● CVE-2023-24516
Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. T...
Pandorafms Pandora Fms<=767
● CVE-2023-24517
Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbit...
Pandorafms Pandora Fms<=767
● CVE-2023-24514
Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora ...
Pandorafms Pandora Fms<=767
● CVE-2023-24515
Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https...
Pandorafms Pandora Fms<=767
● CVE-2023-2807
Pandorafms Pandora Fms<772
● CVE-2022-47373
Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter userna...
Pandorafms Pandora Fms<=766
● CVE-2022-45437
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all allows Cross-Site Scripting (XSS). A user with edition privile...
Pandorafms Pandora Fms=765
● CVE-2022-45436
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager pri...
Pandorafms Pandora Fms=765
● CVE-2022-43978
Pandorafms Pandora Fms<766
● CVE-2022-43979
There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, ...
Pandorafms Pandora Fms<766
● CVE-2022-43980
There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payl...
Pandorafms Pandora Fms<766
● CVE-2021-46679
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements.
Pandorafms Pandora Fms<757
● CVE-2021-46677
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the event filter name field.
Pandorafms Pandora Fms<757
● CVE-2021-46680
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module form name field.
Pandorafms Pandora Fms<=756
● CVE-2021-46678
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the service name field.
Pandorafms Pandora Fms<757
● CVE-2021-46676
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the transactional maps name field.
Pandorafms Pandora Fms<757
● CVE-2022-26310
Pandorafms Pandora Fms<=7.0_ng_760
● CVE-2022-26309
Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.
Pandorafms Pandora Fms<=7.0_ng_759
● CVE-2022-26308
Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are...
Pandorafms Pandora Fms<=7.0_ng_760
● CVE-2022-1648
Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute ...
Pandorafms Pandora Fms<=7.0_ng_760
● CVE-2022-2059
In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administ...
Pandorafms Pandora Fms<=7.0_ng_761
● CVE-2022-2032
In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administ...
Pandorafms Pandora Fms<=7.0_ng_761
● CVE-2022-0507
Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenti...
Pandorafms Pandora Fms<760
● CVE-2021-35501
PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.
Pandorafms Pandora Fms<=754
● CVE-2021-34074
PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. To bypass the built-in protection, a relative path is used in the requests.
Pandorafms Pandora Fms<=754
● CVE-2020-11749
Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run a...
Pandorafms Pandora Fms>=7.0_ng<=746
● CVE-2020-13854
Artica Pandora FMS 7.44 allows privilege escalation.
Pandorafms Pandora Fms=7.44
● CVE-2020-13852
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.
Pandorafms Pandora Fms=7.44
● CVE-2020-13855
Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.
Pandorafms Pandora Fms=7.44
● CVE-2020-13853
Artica Pandora FMS 7.44 has persistent XSS in the Messages feature.
Pandorafms Pandora Fms=7.44
● CVE-2020-13851
Pandorafms Pandora Fms=7.44
● CVE-2020-13850
Artica Pandora FMS 7.44 has inadequate access controls on a web folder.
Pandorafms Pandora Fms=7.44
● CVE-2019-19968
PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data s...
Pandorafms Pandora Fms=742
● CVE-2019-13035
Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files. Moreover, th...
Pandorafms Pandora Fms<7.0_ng_735

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203