Artica: Security Vulnerabilities
Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.
CVSS Score
6.5
EPSS Score
0.019
Published
2018-12-18
Artica Integria IMS 5.0.83 has XSS via the search_string parameter.
CVSS Score
6.1
EPSS Score
0.023
Published
2018-12-17
Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system.
CVSS Score
9.8
EPSS Score
0.056
Published
2018-06-16
Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.
CVSS Score
7.5
EPSS Score
0.067
Published
2018-06-16
Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that general OS information is leaked (e.g., a /var/www pathname typically means Linux or UNIX).
CVSS Score
6.5
EPSS Score
0.01
Published
2017-10-27
Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter.
CVSS Score
5.4
EPSS Score
0.006
Published
2017-10-27
Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file.
CVSS Score
7.2
EPSS Score
0.025
Published
2017-10-27
In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed.
CVSS Score
5.4
EPSS Score
0.006
Published
2017-10-27
The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.
CVSS Score
10.0
EPSS Score
0.656
Published
2010-12-02
Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group parameter in an operation/agentes/ver_agente action to ajax.php or (2) the group_id parameter in an operation/agentes/estado_agente action to index.php, related to operation/agentes/estado_agente.php.
CVSS Score
7.5
EPSS Score
0.053
Published
2010-12-02