Filtered by vendor Artica
Subscriptions
Total
51 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-46681 | 1 Artica | 1 Pandora Fms | 2024-09-17 | 4 Medium |
| A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name field. | ||||
| CVE-2021-3832 | 1 Artica | 1 Integria Ims | 2024-09-17 | 9.8 Critical |
| Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpload() function in order to exploit the vulnerability. | ||||
| CVE-2021-3833 | 1 Artica | 1 Integria Ims | 2024-09-17 | 9.8 Critical |
| Integria IMS login check uses a loose comparator ("==") to compare the MD5 hash of the password provided by the user and the MD5 hash stored in the database. An attacker with a specific formatted password could exploit this vulnerability in order to login in the system with different passwords. | ||||
| CVE-2021-3834 | 1 Artica | 1 Integria Ims | 2024-09-16 | 5.4 Medium |
| Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS). | ||||
| CVE-2010-4280 | 1 Artica | 1 Pandora Fms | 2024-08-07 | N/A |
| Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group parameter in an operation/agentes/ver_agente action to ajax.php or (2) the group_id parameter in an operation/agentes/estado_agente action to index.php, related to operation/agentes/estado_agente.php. | ||||
| CVE-2010-4282 | 1 Artica | 1 Pandora Fms | 2024-08-07 | N/A |
| Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php. | ||||
| CVE-2010-4278 | 1 Artica | 1 Pandora Fms | 2024-08-07 | N/A |
| operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php. | ||||
| CVE-2010-4281 | 1 Artica | 1 Pandora Fms | 2024-08-07 | N/A |
| Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : (colon) character. | ||||
| CVE-2010-4283 | 1 Artica | 1 Pandora Fms | 2024-08-07 | N/A |
| PHP remote file inclusion vulnerability in extras/pandora_diag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv[1] parameter. | ||||
| CVE-2010-4279 | 1 Artica | 1 Pandora Fms | 2024-08-07 | N/A |
| The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter. | ||||
| CVE-2017-15935 | 1 Artica | 1 Pandora Fms | 2024-08-05 | N/A |
| Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file. | ||||
| CVE-2017-15937 | 1 Artica | 1 Pandora Fms | 2024-08-05 | N/A |
| Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that general OS information is leaked (e.g., a /var/www pathname typically means Linux or UNIX). | ||||
| CVE-2017-15934 | 1 Artica | 1 Pandora Fms | 2024-08-05 | N/A |
| Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter. | ||||
| CVE-2017-15936 | 1 Artica | 1 Pandora Fms | 2024-08-05 | N/A |
| In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed. | ||||
| CVE-2018-1000812 | 1 Artica | 1 Integria Ims | 2024-08-05 | N/A |
| Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability in Password recovery process, line 45 of general/password_recovery.php that can result in IntegriaIMS web app user accounts can be taken over. This attack appear to be exploitable via Network access to IntegriaIMS web interface . This vulnerability appears to have been fixed in fixed in versions released after commit f2ff0ba821644acecb893483c86a9c4d3bb75047. | ||||
| CVE-2018-19828 | 1 Artica | 1 Integria Ims | 2024-08-05 | N/A |
| Artica Integria IMS 5.0.83 has XSS via the search_string parameter. | ||||
| CVE-2018-19829 | 1 Artica | 1 Integria Ims | 2024-08-05 | N/A |
| Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known. | ||||
| CVE-2018-11221 | 1 Artica | 1 Pandora Fms | 2024-08-05 | N/A |
| Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system. | ||||
| CVE-2018-11222 | 1 Artica | 1 Pandora Fms | 2024-08-05 | N/A |
| Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint. | ||||
| CVE-2019-19681 | 1 Artica | 1 Pandora Fms | 2024-08-05 | 8.8 High |
| Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defining new alert commands | ||||