Artica vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-32099 A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session Critical 9.8 · May 7, 2021
• CVE-2021-32098 Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.Critical 9.8 · May 7, 2021
• CVE-2020-26518 Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/include/chart_generator.php session_id pCritical 9.8 · Oct 2, 2020
• CVE-2020-8511 In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue thaHigh 7.2 · Mar 23, 2020
• CVE-2020-7935 Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File MHigh 7.2 · Mar 23, 2020
• CVE-2020-5844 index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execHigh 7.2 · Mar 16, 2020
• CVE-2020-8500 In Artica Pandora FMS 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the Updater or Extension component.High 7.2 · Mar 2, 2020
• CVE-2020-8947 functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netHigh 7.2 · Feb 12, 2020
• CVE-2019-20224 netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in tHigh 8.8 · Jan 9, 2020
• CVE-2019-19681 Pandora FMS 7.x suffers from remote code execution vulnerability.High 8.8 · Dec 26, 2019
• CVE-2019-15091 filemgr.php in Artica Integria IMS 5.0.86 allows index.php?sec=wiki&sec2=operation/wiki/wiki&action=upload arbitrary file upload.Critical 9.8 · Aug 16, 2019
• CVE-2018-1000812 Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerabiliHigh 8.1 · Dec 20, 2018
• CVE-2018-11222 Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.High 7.5 · Jun 15, 2018
• CVE-2018-11221 Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manageCritical 9.8 · Jun 15, 2018
• CVE-2017-15935 Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function.High 7.2 · Oct 27, 2017
• CVE-2010-4283 PHP remote file inclusion vulnerability in extras/pandora_diag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL iHigh 7.5 · Dec 2, 2010
• CVE-2010-4282 Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page paHigh 7.5 · Dec 2, 2010
• CVE-2010-4281 Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP High 7.5 · Dec 2, 2010
• CVE-2010-4280 Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group paramHigh 7.5 · Dec 2, 2010
• CVE-2010-4279 The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentiHigh 10 · Dec 2, 2010
• CVE-2010-4278 operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layHigh 9 · Dec 2, 2010