Pandora FMS 7.0NG - Remote Command Injection

Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ipsrc parameter in an index.php?operation/netflow/nfliveview request. id: CVE-2019-20224 info: name: Pandora FMS 7.0NG - Remote Command Injection author: ritikchaddha severity: hig...

Artica Pandora FMS 7.44 - Remote Code Execution

Artica Pandora FMS 7.44 allows remote command execution via the events feature. id: CVE-2020-13851 info: name: Artica Pandora FMS 7.44 - Remote Code Execution author: theamanrawat severity: high description: | Artica Pandora FMS 7.44 allows remote command execution via the events feature. impact:...

CVE-2020-5844

CVE-2020-5844 RCE autenticado en PandoraFMS 7.0-NG 742 Atacantes con privilegios de administrador pueden subir documentos PHP maliciosos. Decodificando la ubicación del archivo en base64 los usuarios pueden obtener una shell como usuario apache. Descubierto por TheCyberGeek Script de PoC en Pytho...

CVE-2022-47373

CVE-2022-47373 PandoraFMS 漏洞标题：反射型跨站脚本 日期：15/02/2023 漏洞作者：Gaurish Kauthankar 厂商主页：https://pandorafms.com/en/ 软件链接：https://github.com/pandorafms/pandorafms 版本： 测试环境：Ubuntu CVE编号：CVE-2022-47373 复现步骤： 1. 在模块库部分的搜索功能中添加 xss payload。 2. 观察 payload 执行。 3. 现在将与受害用户分享包含 xss payload 的 URL，用于窃取...

CVE-2022-43980

CVE-2022-43980 PandoraFMS 漏洞标题：存储型跨站脚本 日期：2023年2月15日 漏洞作者：Gaurish Kauthankar 厂商主页：https://pandorafms.com/en/ 软件链接：https://github.com/pandorafms/pandorafms 受影响版本： 测试环境：Ubuntu CVE编号：CVE-2022-43980 复现步骤 1. 低权限用户创建一个网络地图，将名称设置为XSS载荷。 2. 创建完成后，管理员用户必须点击编辑网络地图链接。 3. XSS载荷将被执行，可用于窃取管理员用户的Cookie值等操作。...

📄 PandoraFMS Netflow 7.0.777.10 Command Injection

PandoraFMS versions 7.0.774 through 7.0.777.10 contain an authenticated command injection vulnerability in the Netflow configuration component. An authenticated attacker with valid credentials can inject arbitrary system commands via the netflownamedir parameter, leading to remote code execution ...

EUVD-2021-22142

Malware in sbrugna...

EUVD-2021-20744

Malware in sbrugna...

EUVD-2019-9556

Malware in sbrugna...

📄 PandoraFMS Netflow Authenticated Remote Code Execution

This Metasploit module exploits a command injection vulnerability in Netflow component of PandoraFMS. The module requires a set of user credentials to modify Netflow settings. Also, Netflow binaries have to be present on the system. This module requires Metasploit: https://metasploit.com/download...

PandoraFMS ITSM 安全漏洞

PandoraFMS ITSM is a desktop help software from ESPPandoraFMS, Inc. A security vulnerability exists in PandoraFMS ITSM version 5.0.105, which stems from improper neutralization of the special elements of the chromiumpath variable, and could lead to OS command injection...

PandoraFMS ITSM 安全漏洞

PandoraFMS ITSM is a desktop help software from ESPPandoraFMS, Inc. A security vulnerability exists in PandoraFMS ITSM version 5.0.105, which stems from improper neutralization of special elements of the backup name field, and could lead to OS command injection...

CVE-2019-19968

PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content...

PandoraFMS 7.0NG.772 - SQL Injection

Exploit Title: PandoraFMS 7.0NG.772 - SQL Injection Date: 21/11/2023 Exploit Author: Osama Yousef Vendor Homepage: https://pandorafms.com/ Software Link: https://github.com/pandorafms/pandorafms/releases/download/v772-LTS/pandorafmsagentlinux-7.0NG.772.tar.gz Version: v7.0NG.772 Tested on: Linux...

📄 PandoraFMS 7.0NG.772 SQL Injection

PandoraFMS version 7.0NG.772 proof of concept authenticated remote SQL injection exploit. Exploit Title: PandoraFMS console v7.0NG.772 - SQL Injection Authenticated Date: 21/11/2023 Exploit Author: Osama Yousef Vendor Homepage: https://pandorafms.com/ Software Link:...

PT-2024-12975 · Undefined · Undefined

NCC Group выпустила третье исследование с оценкой безопасности популярных инструментов RMM, в котором представила обзор на 18 уязвимостей в PandoraFMS. Ранее в поле зрения исследователей попадали множественные уязвимости в Faronics Insight и Nagios XI. PandoraFMS - это приложение для мониторинга ...

PT-2024-12979 · Undefined · Undefined

NCC Group выпустила третье исследование с оценкой безопасности популярных инструментов RMM, в котором представила обзор на 18 уязвимостей в PandoraFMS. Ранее в поле зрения исследователей попадали множественные уязвимости в Faronics Insight и Nagios XI. PandoraFMS - это приложение для мониторинга ...

PandoraFMS Security Vulnerability

PandoraFMS is an application from PandoraFMS USA. It provides a monitoring feature. A security vulnerability exists in PandoraFMS versions 700 through 774 that stems from the presence of a cross-site scripting XSS vulnerability...

PandoraFMS Security Vulnerability

PandoraFMS is an application from PandoraFMS USA. It provides a monitoring feature. A security vulnerability exists in PandoraFMS versions 700 through 774 that stems from the presence of a cross-site scripting XSS vulnerability...

CVE-2023-2807

CVE-2023-2807 affects Pandora FMS (PandoraFMS) installations, including v771 and earlier. The issue is an Authentication Bypass by Spoofing in the password reset workflow, allowing an unauthenticated attacker to initiate a password reset for any user account. Root cause described across connected...