Damodar Naik

**Name of the Vulnerable Software and Affected Versions** Pandora FMS versions prior to v767 **Description** The issue is related to a Server-Side Request Forgery (SSRF) vulnerability in the API checker of Pandora FMS. The application does not validate the URL scheme used while retrieving the API URL, allowing schemes other than http/https, such as file, which could enable a malicious user to fetch internal file content. **Recommendations** For versions prior to v767, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting the API checker to only allow http/https schemes to minimize the risk of internal file content exposure.

**Name of the Vulnerable Software and Affected Versions** Artica PFMS Pandora FMS version v765 **Description** The issue allows Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. As a manager privilege user, an attacker can create a network map containing a malicious name, which acts as an XSS payload. Once created, if an admin user clicks on the edit network maps, the XSS payload will be executed. This could potentially be used for stealing admin users' cookie values. **Recommendations** For Artica PFMS Pandora FMS version v765, as a temporary workaround, consider restricting access to the network map creation feature for manager privilege users until a patch is available. Additionally, restrict the ability to edit network maps for admin users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Artica PFMS Pandora FMS version v765 **Description** The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS). A user with edition privileges can create a payload in the reporting dashboard module. An admin user can observe the payload without interaction, and the attacker can obtain information. **Recommendations** For version v765, consider disabling the reporting dashboard module until a patch is available to prevent the creation of malicious payloads. Restrict access to the reporting dashboard module to minimize the risk of exploitation. Avoid allowing users with edition privileges to create content in the reporting dashboard module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Pandora FMS Console versions v766 and lower **Description** A stored cross-site scripting vulnerability exists in the Create event section. An attacker can exploit this by injecting XSS payloads on popular pages or passing a link to a victim, tricking them into viewing the page with the stored XSS payload. **Recommendations** For versions v766 and lower, consider disabling the Create event section until a patch is available to prevent exploitation of the stored cross-site scripting vulnerability.