[RSS] Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise

Wow, that's a lot of CVEs:

Unauthenticated Admin Account Takeover Via Cron Log File Backups (CVE-2023-4677)
Database Backups are Available to Any User (CVE-2023-41786
Remote Code Execution via MIBS file uploader (CVE-2023-41788)
Unauthenticated Admin Account Takeover Via Malicious Agent and XSS (CVE-2023-41789)
Arbitrary File Read As Root Via GoTTY Page (CVE-2023-41808)
Arbitrary File Read Via API Checker (CVE-2023-41787)
Linux Local Privilege Escalation Via GoTTY Page (CVE-2023-41807)
Path Traversal in get_file.php (CVE-2023-41790)
Stored Cross Site Scripting via SNMP Trap Editor Page (CVE-2023-41792)
Stored Cross Site Scripting via Translation Abuse (CVE-2023-41791)
Stored Cross Site Scripting via User Profile Comment Field (CVE-2023-41809)
System Denial of Service Via GoTTY Page (CVE-2023-41806)
Any User Can Change Any Other User’s Notification Settings (CVE-2023-41813)
Cookies Set Without HTTP ONLY Flag (CVE-2023-41793)
Installer installs MySQL with Weak Credentials (Not assigned)
Stored Cross Site Scripting Via Dashboard Panel (CVE-2023-41810)
Stored Cross Site Scripting via Site News Page (CVE-2023-41811)
User Credentials Written To Access Log In Plaintext (CVE-2023-41794)

https://research.nccgroup.com/2024/01/02/technical-advisory-multiple-vulnerabilities-in-pandorafms-enterprise/

I meant to say...