Artica Pfms Pandora Fms
27 CVEs affecting Artica Pfms Pandora Fms. Latest disclosed: 2023-10-03. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47372 | High | 7.6 | 2023-02-15 | Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability… |
CVE-2022-26310 | High | 7.3 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module cou… |
CVE-2023-24518 | Medium | 6.7 | 2023-10-03 | A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they ar… |
CVE-2023-0828 | Medium | 6.7 | 2023-10-03 | Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers… |
CVE-2022-45437 | Medium | 6.5 | 2023-02-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all allows Cross-Site Scr… |
CVE-2023-24517 | Medium | 6.4 | 2023-08-22 | Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( un… |
CVE-2023-2807 | Medium | 6.4 | 2023-06-13 | Authentication Bypass by Spoofing vulnerability in the password reset process of Pandora FMS allows an unauthenticated attacker to initiate a password reset pr… |
CVE-2022-47373 | Medium | 6.4 | 2023-02-15 | Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget passwor… |
CVE-2023-24514 | Medium | 6.3 | 2023-08-22 | Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing… |
CVE-2022-45436 | Medium | 6.1 | 2023-02-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cro… |
CVE-2023-24516 | Medium | 5.9 | 2023-08-22 | Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin use… |
CVE-2022-43979 | Medium | 5.9 | 2023-01-27 | There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted… |
CVE-2022-0507 | Medium | 5.8 | 2022-03-10 | Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerabil… |
CVE-2022-1648 | Medium | 5.7 | 2022-07-26 | Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images… |
CVE-2022-43978 | Medium | 5.6 | 2023-01-27 | There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a… |
CVE-2023-24515 | Medium | 5.2 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API U… |
CVE-2022-43980 | Medium | 5.2 | 2023-01-27 | There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, inc… |
CVE-2021-46681 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name… |
CVE-2021-46680 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module form name field. |
CVE-2021-46679 | Medium | 4.0 | 2022-08-05 | A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements. |