CVE-2010-4279

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhashpwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhashuser parameter, in conjunction with the md5 hash of "admin" in the...

CVE-2010-4281

Incomplete blacklist vulnerability in the safeurlextraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : colon character...

CVE-2010-4282

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via 1 the page parameter to ajax.php or 2 the id parameter to general/pandorahelp.php, and allow remote attackers to include and execute, create, modify, or...

CVE-2010-4280

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...

CVE-2010-4282

Pandora FMS vulnerability CVE-2010-4282: multiple directory traversal / local file inclusion flaws in Pandora FMS before 3.1.1 allow remote attackers to include and execute local files via parameters page in ajax.php, id in general/pandora_help.php, and layout in operation/agentes/networkmap.php....

CVE-2010-4280

CVE-2010-4280 affects Pandora FMS before 3.1.1. The vulnerabilities are SQL injection flaws in two parameters: id_group (operation/agentes/ver_agente via ajax.php) and group_id (operation/agentes/estado_agente via index.php), related to operation/agentes/estado_agente.php. Remote authenticated us...

EUVD-2010-4251

operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php...

CVE-2010-4283

CVE-2010-4283 is a remote PHP code execution vulnerability in Pandora FMS (before 3.1.1) caused by a remote file inclusion in extras/pandora_diag.php when processing argv[1]. The issue allows an attacker to inject and execute arbitrary PHP via a crafted URL parameter, with PoC showing exploitatio...

CVE-2010-4281

CVE-2010-4281 describes an incomplete blacklist vulnerability in Pandora FMS prior to 3.1.1. The issue lies in the safe_url_extraclean function used by ajax.php (parameter page); it filters the colon character but fails to prevent UNC paths, allowing an attacker to reference remote resources (e.g...

CVE-2010-4279

Pandora FMS 3.1 and earlier are affected by an authentication bypass (CVE-2010-4279). The default config leaves loginhash_pwd empty, allowing remote bypass by sending a request to index.php with loginhash_user=admin and loginhash_data containing the MD5 of “admin”; this bypass gives full/complete...

CVE-2010-4278

Pandora FMS (versions up to 3.1.0 affected) contains an OS command injection in operation/agentes/networkmap.php. The vulnerability arises from the layout parameter in the networkmap action, which is not properly sanitized, allowing an authenticated remote user to inject shell commands via the la...

Pandora FMS Console Detection

The web console for Pandora FMS, an open source monitoring system, is running on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid50860; scriptversion"1.11"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/12";...

Pandora FMS <=3.1 multiple vulnerabilities-vulnerability warning-the black bar safety net

Pandora FMS is a server monitoring software, Pandora FMS =version 3.1 there are multiple security vulnerabilities, including:directory traversal, SQL injection, system command injection, authentication bypass and other vulnerabilities. May lead to multiple security threats. +info: Pandora FMS = 3...

Pandora FMS Detection (HTTP)

HTTP based detection of Pandora FMS. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.100926";...

Pandora FMS <= 3.1 Multiple Input Validation Vulnerabilities - Active Check

Pandora FMS is prone to an authentication bypass vulnerability as well as the following input-validation vulnerabilities: - A commandinjection vulnerability - Multiple SQL injection SQLi vulnerabilities - A remote file include RFI vulnerability - An arbitrary PHP code execution vulnerability -...

Pandora FMS Authentication Bypass And Multiple Input Validation Vulnerabilities

Pandora FMS is prone to an authentication-bypass vulnerability as well as the following input-validation vulnerabilities: 1. A command-injection vulnerability 2. Multiple SQL-injection vulnerabilities 3. A remote file-include vulnerability 4. An arbitrary PHP-code-execution vulnerability 5...

Pandora FMS Console Authentication Bypass

The Pandora FMS console hosted on the remote web server is affected by an authentication bypass vulnerability. The 'auto login hash password' feature allows third parties to authenticate using a combination of username and a shared secret. This shared secret is undefined by default, which means i...

Pandora FMS Authentication Bypass and Multiple Input Validation Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Pandora FMS Authentication Bypass and Multiple Input Validation Vulnerabilities CVE IDs in this security advisory: 1 Authentication bypass - CVE-2010-4279 2 OS Command Injection - CVE-2010-4278 3 SQL Injection - CVE-2010-4280 4 Blind SQL Injection -...

Pandora FMS 3.1 - Authentication Bypass

Pandora FMS 3.1 - Authentication Bypass + Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers,...

Pandora Fms 3.1 - OS Command Injection

Pandora Fms 3.1 - OS Command Injection + Introduction Pandora FMS for Pandora Flexible Monitoring System is a software solution for monitoring computer networks. It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers,...