CVE-2023-24515

Server-Side Request Forgery SSRF vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, which could allow a malicious user to...

CVE-2023-24516

Cross-site Scripting XSS vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms...

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue unrestricted file upload to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms...

Cross site scripting

Cross-site Scripting XSS vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, which could allow a malicious user to...

Cross site scripting

Cross-site Scripting XSS vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24517 Remote Code Execution via Unrestricted File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue unrestricted file upload to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24517

Summary: CVE-2023-24517 affects the Pandora FMS File Manager component, enabling an unrestricted file upload that can be used to execute arbitrary system commands. Affected versions include Pandora FMS prior to 7.67 (notably v7.67 is cited as the fixed version). Root cause described in PT Securit...

CVE-2023-24517 Remote Code Execution via Unrestricted File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue unrestricted file upload to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24516

CVE-2023-24516 is a Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component. The issue can allow an attacker to steal the admin session cookie, with little user interaction, and affects Pandora FMS v767 and earlier on all platforms. The nature of the flaw is stored XSS ...

CVE-2023-24516 Stored Cross Site Scripting - Special Days Module

Cross-site Scripting XSS vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24516 Stored Cross Site Scripting - Special Days Module

Cross-site Scripting XSS vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24514

The CVE-2023-24514 issue is a Cross-site Scripting (XSS) vulnerability in the Pandora FMS Visual Console Module that could enable session hijacking and phishing. Concrete details across connected sources show affected software: Pandora FMS prior to v767 with the Visual Console Module susceptible ...

CVE-2023-24514 Stored Cross Site Scripting Vulnerability in Visual Console Module

Cross-site Scripting XSS vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24514 Stored Cross Site Scripting Vulnerability in Visual Console Module

Cross-site Scripting XSS vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms...

CVE-2023-24515 Server side request forgery in api checker

Server-Side Request Forgery SSRF vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, which could allow a malicious user to...

CVE-2023-24515 Server side request forgery in api checker

Server-Side Request Forgery SSRF vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, which could allow a malicious user to...

CVE-2023-24515

The CVE-2023-24515 entry describes a Server-Side Request Forgery (SSRF) vulnerability in the API checker of Pandora FMS. The root cause is that the application does not validate the URL scheme when retrieving the API URL, allowing schemes such as file in addition to http/https. This could enable ...

PT-2023-19663 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions prior to v767 Description: A Cross-site Scripting XSS issue in the Special Days component allows an attacker to steal the session cookie value of admin users with little user interaction. Recommendations: For versions pri...

PT-2023-19664 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions prior to 7.67 Description: The issue allows an attacker to execute arbitrary system commands by exploiting an unrestricted file upload vulnerability in the Pandora FMS File Manager component. Recommendations: For versions...