Home / CVE assignment and publication / Coordinated CVEs

Coordinated CVEs

CVE Vulnerability description Publication Date Solution Assigner CNA Reported By:
CVE-2022-47373 Reflected Cross-Site Scripting in the Search functionality of the module Library in Pandora FMS Console v766 and lower. This vulnerability arises in the forgot password functionality where the username parameter does not have proper input validation/sanitization, resulting in the execution of malicious JavaScript payload. 20-12-2022 This vulnerability has been solved in the 767 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-47372 Stored Cross-Site Scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the stored XSS payload. 20-12-2022 This vulnerability has been solved in the 767 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-45437 Improper Neutralization of Input During Web Page Generation vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). A user with edition privileges can create a Payload in the reporting dashboard module. An admin user can observe the Payload without interaction and attacker can get information. 16-11-2022 This vulnerability has been solved in the 766 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-45436 Improper Neutralization of Input During Web Page Generation vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must click on the edit network maps and XSS payload will be executed, which could be used for stealing admin users cookie value. 16-11-2022 This vulnerability has been solved in the 766 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-43980 There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS payload will be executed. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie. 03-11-2022 This vulnerability has been solved in the 766 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-43979 There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code execution. 03-11-2022 This vulnerability has been solved in the 766 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-43978 There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order to pass the authentication check. 03-11-2022 This vulnerability has been solved in the 766 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-2059 In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system. 14-06-2022 This vulnerability has been solved in the 762 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-2032 In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system. 14-06-2022 This vulnerability has been solved in the 762 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-1648 Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execution with running application privilege. 13-05-2022 This vulnerability has been solved in the 761 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-26310 Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module could create, modify or delete any user with full admin privilege. The impact could lead to a vertical privilege escalation to access the privileges of a higher-level user or typically an admin user. 13-05-2022 This vulnerability has been solved in the 761 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-26309 Pandora FMS v7.0NG.760 and below allows a Cross-Site Request Forgery in Bulk operation (User operation) resulting in an elevation of privilege to Administrator group. 13-05-2022 This vulnerability has been solved in the 761 version of Pandora FMS. Ártica PFMS External analysis
CVE-2022-26308 Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could create, delete, view existing keys which are outside the intended role. 13-05-2022 This vulnerability has been solved in the 761 version of Pandora FMS. Ártica PFMS External analysis
CVE-2021-46681 There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the massive operation name field. 21-02-2022 This vulnerability has been solved in the 757 version of Pandora FMS. Ártica PFMS Internal analysis
CVE-2021-46680 There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the module form name field. 21-02-2022 This vulnerability has been solved in the 757 version of Pandora FMS. Ártica PFMS Internal analysis
CVE-2021-46679 There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through service elements. 21-02-2022 This vulnerability has been solved in the 757 version of Pandora FMS. Ártica PFMS Internal analysis
CVE-2021-46678 There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the service name field. 21-02-2022 This vulnerability has been solved in the 757 version of Pandora FMS. Ártica PFMS Internal analysis
CVE-2021-46677 There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the event filter name field. 21-02-2022 This vulnerability has been solved in the 757 version of Pandora FMS. Ártica PFMS Internal analysis
CVE-2021-46676 There is an XSS vulnerability in Pandora FMS version 756 and below, which allows an attacker to execute javascript code through the transactional maps name field. 21-02-2022 This vulnerability has been solved in the 757 version of Pandora FMS. Ártica PFMS Internal analysis
CVE-2022-0507 Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL. 10-02-2022 This vulnerability has been solved in the 760 version of Pandora FMS. Ártica PFMS -