Coordinated CVEs
| CVE | Vulnerability description | Publication Date | Solution | Assigner CNA | Reported By: |
|---|---|---|---|---|---|
| CVE-2023-24517 | Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms. | 22-02-2023 | This vulnerability has been solved in the 769 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2023-24516 | Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms. | 22-02-2023 | This vulnerability has been solved in the 769 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2023-24515 | Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, which could allow a malicious user to fetch internal file content. This issue affects Pandora FMS v767 version and prior versions on all platforms. | 22-02-2023 | This vulnerability has been solved in the 769 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2023-24514 | Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms. | 22-02-2023 | This vulnerability has been solved in the 769 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-47373 | Reflected Cross-Site Scripting in the Search functionality of the module Library in Pandora FMS Console v766 and lower. This vulnerability arises in the forgot password functionality where the username parameter does not have proper input validation/sanitization, resulting in the execution of malicious JavaScript payload. | 20-12-2022 | This vulnerability has been solved in the 767 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-47372 | Stored Cross-Site Scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the stored XSS payload. | 20-12-2022 | This vulnerability has been solved in the 767 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-45437 | Improper Neutralization of Input During Web Page Generation vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). A user with edition privileges can create a Payload in the reporting dashboard module. An admin user can observe the Payload without interaction and attacker can get information. | 16-11-2022 | This vulnerability has been solved in the 766 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-45436 | Improper Neutralization of Input During Web Page Generation vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value. | 16-11-2022 | This vulnerability has been solved in the 766 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-43980 | There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS payload will be executed. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie. | 03-11-2022 | This vulnerability has been solved in the 766 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-43979 | There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code execution. | 03-11-2022 | This vulnerability has been solved in the 766 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-43978 | There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order to pass the authentication check. | 03-11-2022 | This vulnerability has been solved in the 766 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-2059 | In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system. | 14-06-2022 | This vulnerability has been solved in the 762 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-2032 | In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system. | 14-06-2022 | This vulnerability has been solved in the 762 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-1648 | Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execution with running application privilege. | 13-05-2022 | This vulnerability has been solved in the 761 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-26310 | Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user. | 13-05-2022 | This vulnerability has been solved in the 761 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-26309 | Pandora FMS v7.0NG.760 and below allows a Cross-Site Request Forgery in Bulk operation (User operation) resulting in an elevation of privilege to Administrator group. | 13-05-2022 | This vulnerability has been solved in the 761 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2022-26308 | Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role. | 13-05-2022 | This vulnerability has been solved in the 761 version of Pandora FMS. | Ártica PFMS | External analysis |
| CVE-2021-46681 | There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the massive operation name field. | 21-02-2022 | This vulnerability has been solved in the 757 version of Pandora FMS. | Ártica PFMS | Internal analysis |
| CVE-2021-46680 | There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the module form name field. | 21-02-2022 | This vulnerability has been solved in the 757 version of Pandora FMS. | Ártica PFMS | Internal analysis |
| CVE-2021-46679 | There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through service elements. | 21-02-2022 | This vulnerability has been solved in the 757 version of Pandora FMS. | Ártica PFMS | Internal analysis |
| CVE-2021-46678 | There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the service name field. | 21-02-2022 | This vulnerability has been solved in the 757 version of Pandora FMS. | Ártica PFMS | Internal analysis |
| CVE-2021-46677 | There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the event filter name field. | 21-02-2022 | This vulnerability has been solved in the 757 version of Pandora FMS. | Ártica PFMS | Internal analysis |
| CVE-2021-46676 | There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the transactional maps name field. | 21-02-2022 | This vulnerability has been solved in the 757 version of Pandora FMS. | Ártica PFMS | Internal analysis |
| CVE-2022-0507 | Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL. | 10-02-2022 | This vulnerability has been solved in the 760 version of Pandora FMS. | Ártica PFMS | - |
Compartir en Redes Sociales
