CVE-2011-2283

Unspecified vulnerability in the PeopleSoft Enterprise FMS component in Oracle PeopleSoft Products 9.0 Bundle 36 and 9.1 Bundle 13 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Payables...

Pandora FMS Monitoring 2.1 1.3.x - Multiple Vulnerabilities

Document Title: =============== Pandora FMS Monitoring 2.1 1.3.x - Multiple Vulnerabilities Release Date: ============= 2011-07-18 Vulnerability Laboratory ID VL-ID: ==================================== 105 Product & Service Introduction: =============================== Pandora FMS is a monitorin...

Pandora FMS Monitoring 2.1 1.3.x - Multiple Vulnerabilities

Document Title: =============== Pandora FMS Monitoring 2.1 1.3.x - Multiple Vulnerabilities Release Date: ============= 2011-07-18 Vulnerability Laboratory ID VL-ID: ==================================== 105 Product & Service Introduction: =============================== Pandora FMS is a monitorin...

Pandora FMS (id_agent) - SQL Injection Vulnerability

Document Title: =============== Pandora FMS idagent - SQL Injection Vulnerability References Source: ==================== OSVDB-ID: 61222 http://osvdb.org/show/osvdb/61222 EDB-ID: 10570 http://www.exploit-db.com/exploits/10570/ PID: 84127...

Pandora FMS (id_agent) - SQL Injection Vulnerability

Document Title: =============== Pandora FMS idagent - SQL Injection Vulnerability References Source: ==================== OSVDB-ID: 61222 http://osvdb.org/show/osvdb/61222 EDB-ID: 10570 http://www.exploit-db.com/exploits/10570/ PID: 84127...

Pandora FMS 3.2.1 Cross Site Request Forgery

Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP" Date: 12-07-2011 Author: Mehdi Boukazoula Software Link: http://pandorafms.org/ Version: v 3.2.1 Tested on: v = Pandora XSRF exploit Click submit input...

Pandora FMS v3.2.1 Cross Site Request Forgery

Exploit for php platform in category web applications Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP" Date: 12-07-2011 Author: Mehdi Boukazoula Software Link: http://pandorafms.org/ Version: v 3.2.1...

Pandora Fms 3.2.1 - Cross-Site Request Forgery

Pandora Fms 3.2.1 - Cross-Site Request Forgery Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP" Date: 12-07-2011 Author: Mehdi Boukazoula Software Link: http://pandorafms.org/ Version: v 3.2.1 Tested...

Pandora Fms 3.2.1 - Cross-Site Request Forgery

Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP" Date: 12-07-2011 Author: Mehdi Boukazoula Software Link: http://pandorafms.org/ Version: v 3.2.1 Tested on: v = Pandora XSRF exploit Click submit input...

CVE-2011-0612

Adobe Flash Media Server (FMS) is affected by CVE-2011-0612: versions before 3.5.6 and 4.x before 4.0.2 are vulnerable to a remote denial-of-service via XML data corruption. The available sources describe the vulnerability and cite APSB11-11 as the mitigation/patch guidance from Adobe. The OpenVA...

Pandora FMS Console Default Credentials

It is possible to log into the remote Pandora FMS console by providing the default credentials admin / pandora. A remote attacker can exploit this to gain administrative control of the Pandora FMS installation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

Sql injection

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...

Remote file inclusion

PHP remote file inclusion vulnerability in extras/pandoradiag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv1 parameter...

Design/Logic Flaw

Incomplete blacklist vulnerability in the safeurlextraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : colon character...

Directory traversal

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via 1 the page parameter to ajax.php or 2 the id parameter to general/pandorahelp.php, and allow remote attackers to include and execute, create, modify, or...

CVE-2010-4280

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...

CVE-2010-4281

Incomplete blacklist vulnerability in the safeurlextraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : colon character...

CVE-2010-4279

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhashpwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhashuser parameter, in conjunction with the md5 hash of "admin" in the...

CVE-2010-4283

PHP remote file inclusion vulnerability in extras/pandoradiag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv1 parameter...

CVE-2010-4282

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via 1 the page parameter to ajax.php or 2 the id parameter to general/pandorahelp.php, and allow remote attackers to include and execute, create, modify, or...