CVE-2020-5844

CVE-2020-5844 PandoraFMS 7.0-NG 742의 인증된 RCE 관리자 권한의 공격자는 악성 PHP 문서를 업로드할 수 있습니다. base64 파일 위치를 디코딩함으로써 사용자는 apache 사용자로 셸을 획득할 수 있습니다. TheCyberGeek이 발견함 PoC 파이썬 스크립트 Usage: python3 CVE-2020-5844.py URL USER PASS PHPREVERSESHELL Ex: python3 CVE-2020-5844.py http://10.0.0.2/pandoraconsole admin...

CVE-2022-47373

CVE-2022-47373 PandoraFMS Exploit Title: 반사형 크로스 사이트 스크립팅 날짜: 15/02/2023 익스플로잇 작성자: Gaurish Kauthankar 공급업체 홈페이지: https://pandorafms.com/en/ 소프트웨어 링크: https://github.com/pandorafms/pandorafms 버전: 테스트 환경: Ubuntu CVE : CVE-2022-47373 재현 단계: 1. 모듈 라이브러리 섹션의 검색 기능에 XSS 페이로드를 추가합니다. 2. 페이로드 실행을 확인합니다...

CVE-2022-43980

CVE-2022-43980 PandoraFMS 익스플로잇 제목: 저장형 크로스 사이트 스크립팅 날짜: 2023-02-15 익스플로잇 작성자: Gaurish Kauthankar 공급업체 홈페이지: https://pandorafms.com/en/ 소프트웨어 링크: https://github.com/pandorafms/pandorafms 버전: 테스트 환경: Ubuntu CVE ID: CVE-2022-43980 재현 단계 1. 낮은 권한의 사용자로, 이름에 XSS 페이로드를 포함한 네트워크 맵을 생성합니다. 2. 생성 후, 관리자...

Pandora FMS 7.0NG - Remote Command Injection

Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ipsrc parameter in an index.php?operation/netflow/nfliveview request. id: CVE-2019-20224 info: name: Pandora FMS 7.0NG - Remote Command Injection author: ritikchaddha severity: hig...

Artica Pandora FMS 7.44 - Remote Code Execution

Artica Pandora FMS 7.44 allows remote command execution via the events feature. id: CVE-2020-13851 info: name: Artica Pandora FMS 7.44 - Remote Code Execution author: theamanrawat severity: high description: | Artica Pandora FMS 7.44 allows remote command execution via the events feature. impact:...

📄 PandoraFMS Netflow 7.0.777.10 Command Injection

PandoraFMS versions 7.0.774 through 7.0.777.10 contain an authenticated command injection vulnerability in the Netflow configuration component. An authenticated attacker with valid credentials can inject arbitrary system commands via the netflownamedir parameter, leading to remote code execution ...

EUVD-2021-22142

Malware in sbrugna...

EUVD-2021-20744

Malware in sbrugna...

EUVD-2019-9556

Malware in sbrugna...

📄 PandoraFMS Netflow Authenticated Remote Code Execution

This Metasploit module exploits a command injection vulnerability in Netflow component of PandoraFMS. The module requires a set of user credentials to modify Netflow settings. Also, Netflow binaries have to be present on the system. This module requires Metasploit: https://metasploit.com/download...

PandoraFMS ITSM 安全漏洞

PandoraFMS ITSM is a desktop help software from ESPPandoraFMS, Inc. A security vulnerability exists in PandoraFMS ITSM version 5.0.105, which stems from improper neutralization of the special elements of the chromiumpath variable, and could lead to OS command injection...

PandoraFMS ITSM 安全漏洞

PandoraFMS ITSM is a desktop help software from ESPPandoraFMS, Inc. A security vulnerability exists in PandoraFMS ITSM version 5.0.105, which stems from improper neutralization of special elements of the backup name field, and could lead to OS command injection...

CVE-2019-19968

PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content...

PandoraFMS 7.0NG.772 - SQL Injection

Exploit Title: PandoraFMS 7.0NG.772 - SQL Injection Date: 21/11/2023 Exploit Author: Osama Yousef Vendor Homepage: https://pandorafms.com/ Software Link: https://github.com/pandorafms/pandorafms/releases/download/v772-LTS/pandorafmsagentlinux-7.0NG.772.tar.gz Version: v7.0NG.772 Tested on: Linux...

📄 PandoraFMS 7.0NG.772 SQL Injection

PandoraFMS version 7.0NG.772 proof of concept authenticated remote SQL injection exploit. Exploit Title: PandoraFMS console v7.0NG.772 - SQL Injection Authenticated Date: 21/11/2023 Exploit Author: Osama Yousef Vendor Homepage: https://pandorafms.com/ Software Link:...

PT-2024-12975 · Undefined · Undefined

NCC Group выпустила третье исследование с оценкой безопасности популярных инструментов RMM, в котором представила обзор на 18 уязвимостей в PandoraFMS. Ранее в поле зрения исследователей попадали множественные уязвимости в Faronics Insight и Nagios XI. PandoraFMS - это приложение для мониторинга ...

PT-2024-12979 · Undefined · Undefined

NCC Group выпустила третье исследование с оценкой безопасности популярных инструментов RMM, в котором представила обзор на 18 уязвимостей в PandoraFMS. Ранее в поле зрения исследователей попадали множественные уязвимости в Faronics Insight и Nagios XI. PandoraFMS - это приложение для мониторинга ...

PandoraFMS Security Vulnerability

PandoraFMS is an application from PandoraFMS USA. It provides a monitoring feature. A security vulnerability exists in PandoraFMS versions 700 through 774 that stems from the presence of a cross-site scripting XSS vulnerability...

PandoraFMS Security Vulnerability

PandoraFMS is an application from PandoraFMS USA. It provides a monitoring feature. A security vulnerability exists in PandoraFMS versions 700 through 774 that stems from the presence of a cross-site scripting XSS vulnerability...

CVE-2023-2807

CVE-2023-2807 affects Pandora FMS (PandoraFMS) installations, including v771 and earlier. The issue is an Authentication Bypass by Spoofing in the password reset workflow, allowing an unauthenticated attacker to initiate a password reset for any user account. Root cause described across connected...