Pandora FMS

Artica Pandora FMS 7.44 allows remote command execution via the events feature.

Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.

Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system commands…

Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS.

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier.

Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views.

Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature.

Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.

PandoraFMS <=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager.

Artica Pandora FMS 7.44 allows privilege escalation.

Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset process for any user account without proper authentication.

There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection.

Found a potential security vulnerability inside the Pandora API.

A post-authentication SQL Injection vulnerability within the filters parameter of the extensions/agents_modules_csv functionality.

Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privileg…

Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group.

A post-authentication arbitrary file read vulnerability within the server plugins section in plugin edition feature.

Artica Pandora FMS 7.44 has inadequate access controls on a web folder.

Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower.

Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file.

Artica Pandora FMS 7.0 NG before 735 suffers from local privilege escalation due to improper permissions on C:\PandoraFMS and its sub-folders, allowing standard users to create new files.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS).

A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against.

Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server.