CVE-2023-41812 Uploading executables via the file manager

Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allowed PHP executable files to be uploaded through the file manager. This issue affects Pandora FMS: from 700 through 773...

CVE-2023-41811

The CVE-2023-41811 entry is about an XSS flaw in Pandora FMS (versions 700–773) where improper input neutralization during web page generation allows JavaScript execution in the news section of the web console. Connected PT Security reports enumerate the issue among 18 vulnerabilities and confirm...

CVE-2023-41811 Stored XSS Via Site News Page

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pandora FMS on all allows Cross-Site Scripting XSS. This vulnerability allowed Javascript code to be executed in the news section of the web console. This issue affects Pandora FMS: from 700 throug...

CVE-2023-41810 Stored XSS Via Dashboard Panel

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pandora FMS on all allows Cross-Site Scripting XSS. This vulnerability allowed Javascript code to be executed in some Widgets' text box. This issue affects Pandora FMS: from 700 through 773...

CVE-2023-41810

CVE-2023-41810 is a Cross-Site Scripting (XSS) vulnerability in Pandora FMS, caused by improper input neutralization during web page generation. It affects Pandora FMS versions 700–773, allowing injected JavaScript in certain Widgets text boxes. Multiple connected sources indicate fixes were rele...

CVE-2023-41808 Arbitrary File Read As Root Via GoTTY Page

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through 773...

CVE-2023-41808 Arbitrary File Read As Root Via GoTTY Page

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and read sensitive files as if they were root. This issue affects Pandora FMS: from 700 through 773...

CVE-2023-41808

CVE-2023-41808 affects Pandora FMS up to version 773. It enables an unauthenticated user to read arbitrary files as root via the GoTTY page (GoTTY integration). Root-cause: improper privilege management. A fix exists in Pandora FMS v773/v774/v775; upgrade to a version containing the fix. If upgra...

CVE-2023-41807

Pandora FMS up to v773 is affected by CVE-2023-41807, a Linux local privilege escalation via the GoTTY page. The underlying issue is improper privilege management on the Pandora FMS console, enabling an unprivileged user to escalate to root through the GoTTY interface. Reports from PT Security an...

CVE-2023-41807 Linux Local Privilege Escalation Via GoTTY Page

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the system shell. This issue affects Pandora FMS: from 700 through 773...

CVE-2023-41807 Linux Local Privilege Escalation Via GoTTY Page

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the system shell. This issue affects Pandora FMS: from 700 through 773...

CVE-2023-41806 Misassignment of privileges can cause DOS attack

Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could cause a DOS attack that affects the availability of the Pandora FMS server. This issue affects Pandora FMS: from 700 through 773...

CVE-2023-41806

CVE-2023-41806 affects Pandora FMS versions 700–773 and is described as an improper privilege management vulnerability that can permit privilege escalation and a denial of service affecting server availability. The connected PT Security/NCC Group sources identify Pandora FMS as the affected produ...

CVE-2023-41792 Lack of Authorization and Stored XSS Via SNMP Trap Editor Page

Cross-Site Request Forgery CSRF vulnerability in Pandora FMS on all allows Cross-Site Scripting XSS. This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issue affects Pandora FMS: from 700 through 773...

CVE-2023-41792

Summary : CVE-2023-41792 is a CSRF issue in Pandora FMS that enables Stored XSS via the SNMP Trap Editor. Affected versions are 700–773. The connected PT/PTSecurity entries confirm this CSRF/XSS combination and list Pandora FMS as the affected product. The NVD entry mirrors the description and im...

CVE-2023-41791 Lack of Authorization and Stored XSS Via Translation Abuse

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pandora FMS on all allows Cross-Site Scripting XSS. This vulnerability allowed users with low privileges to introduce Javascript executables via a translation string that could affect the integrity...

CVE-2023-41791

CVE-2023-41791 is an XSS in Pandora FMS (versions 700–773) caused by improper neutralization of input during web page generation via translation strings. The issue allows low-privilege users to inject JavaScript affecting configuration file integrity. Connected sources corroborate affected versio...

CVE-2023-41791 Lack of Authorization and Stored XSS Via Translation Abuse

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pandora FMS on all allows Cross-Site Scripting XSS. This vulnerability allowed users with low privileges to introduce Javascript executables via a translation string that could affect the integrity...

CVE-2023-41790

CVE-2023-41790 is a path traversal vulnerability in Pandora FMS (versions 700–773) that allows access to server configuration files via an uncontrolled search path element, potentially compromising the database. Public descriptions consistently cite traversal through get_file.php as the root caus...

CVE-2023-41790 Traversal Path on PHP file

Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows to access the server configuration file and to compromise the database. This issue affects Pandora FMS: from 700 through 773...