| CVE-2021-36697 | MOYENNE6.7 | With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rewrite Rule with a type definition. A normal PHP file can be uploaded with this new "file type" and the code can be executed with an HTTP request. | 03/11/2021 |
| CVE-2021-34075 | MOYENNE5.9 | In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can access. | 30/06/2021 |
| CVE-2021-32100 | MOYENNE6.5 | A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user. | 07/05/2021 |
| CVE-2021-32099 | CRITIQUE9.8 | A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass. | 07/05/2021 |
| CVE-2021-32098 | CRITIQUE9.8 | Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization. | 07/05/2021 |
| CVE-2020-26518 | CRITIQUE9.8 | Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/include/chart_generator.php session_id parameter. | 02/10/2020 |
| CVE-2020-8511 | ÉLEVÉE7.2 | In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue than CVE-2020-7935 and CVE-2020-8500. | 23/03/2020 |
| CVE-2020-7935 | ÉLEVÉE7.2 | Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File Manager. An attacker can create a (or use an existing) directory that is externally accessible to store PHP files. The filename and the exact path is known by th | 23/03/2020 |
| CVE-2020-8497 | MOYENNE5.3 | In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps. | 23/03/2020 |
| CVE-2020-5844 | ÉLEVÉE7.2 | index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020. | 16/03/2020 |
| CVE-2020-8500 | ÉLEVÉE7.2 | In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component. NOTE: The vendor reports that this is intended functionality | 02/03/2020 |
| CVE-2020-8947 | ÉLEVÉE7.2 | functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224. | 12/02/2020 |
| CVE-2019-20050 | MOYENNE6.8 | Pandora FMS ≤ 7.42 suffers from a remote code execution vulnerability. To exploit the vulnerability, an authenticated user should create a new folder with a "tricky" name in the filemanager. The exploit works when the php-fileinfo extension is disabled on the host system. The attacker must include shell metacharacters | 30/01/2020 |
| CVE-2019-20224 | ÉLEVÉE8.8 | netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742. | 09/01/2020 |
| CVE-2019-19681 | ÉLEVÉE8.8 | Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state | 26/12/2019 |
| CVE-2018-11222 | ÉLEVÉE7.5 | Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint. | 16/06/2018 |
| CVE-2018-11221 | CRITIQUE9.8 | Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system. | 16/06/2018 |
| CVE-2017-15937 | MOYENNE6.5 | Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that general OS information is leaked (e.g., a /var/www pathname typically means Linux or UNIX). | 27/10/2017 |
| CVE-2017-15936 | MOYENNE5.4 | In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed. | 27/10/2017 |
| CVE-2017-15935 | ÉLEVÉE7.2 | Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file. | 27/10/2017 |