1243 matches found
CVE-2022-43978: Improper Authentication
There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order t...
CVE-2022-43978
Pandora FMS vulnerability CVE-2022-43978 affects Pandora FMS version 7.64 (v764). The issue is an improper authentication bypass: the application verifies a valid session when a user is not attempting to log in, due to a static secret in the generatePublicHash function. An attacker who knows a va...
CVE-2022-43980
CVE-2022-43980 describes a stored cross-site scripting vulnerability in Pandora FMS v765 within the network maps editing feature. An attacker can edit a network map to inject an XSS payload; when an admin user clicks the edited map, the payload can execute and potentially exfiltrate the admin coo...
CVE-2022-43979 Path Traversal leading to Local File Inclusion
There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck,...
PT-2023-14420 · Unknown · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Pandora FMS version 7.64 Description: The issue is related to improper authentication. The application checks for a valid session when a user is not attempting to log in. A static secret in the generatePublicHash function allows an attacker...
CVE-2022-43979: Unrestricted Upload of File with Dangerous Type
There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck,...
CVE-2022-43978 Limited Authentication bypass due to hardcoded secret
There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order t...
The Onyx Fms: Monitor And Prevent Telecom Fraud In Real-time
By Owais Sultan Telco fraud, telecom fraud, telecommunications fraud – regardless of the name used, it refers to one thing that… This is a post from HackRead.com Read the original post: The Onyx Fms: Monitor And Prevent Telecom Fraud In Real-time...
The vulnerability of the `include/chart_generator.php` script of the Pandora Console component, a monitoring and management system for IT environments in the Pandora FMS framework. This script allows attackers to bypass security restrictions and execute arbitrary SQL code.
The vulnerability of the include/chartgenerator.php implementation of the Pandora Console component in the Pandora FMS monitoring and management system is related to the lack of measures taken to protect the SQL query structure during the processing of the sessionid parameter. Exploiting this...
PT-2022-5375 · Apache +2 · Apache Tomcat +2
Name of the Vulnerable Software and Affected Versions: Apache Tomcat affected versions not specified Pandora FMS version 7.65 Description: The issue concerns errors in synchronization when using a shared resource in Apache Tomcat, potentially allowing a remote attacker to gain unauthorized access...
CVE-2021-46677
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the event filter name field...
CVE-2021-46678
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the service name field...
CVE-2021-46681
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name field...
CVE-2021-46680
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module form name field...
CVE-2021-46679
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements...
CVE-2021-46681
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name field...
CVE-2021-46677
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the event filter name field...
CVE-2021-46680
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module form name field...