Filtered by vendor Cacti
Subscriptions
Total
131 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-17358 | 3 Cacti, Debian, Opensuse | 3 Cacti, Debian Linux, Leap | 2024-11-21 | 8.1 High |
| Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module. | ||||
| CVE-2019-17357 | 1 Cacti | 1 Cacti | 2024-11-21 | 6.5 Medium |
| Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery. | ||||
| CVE-2019-16723 | 1 Cacti | 1 Cacti | 2024-11-21 | 4.3 Medium |
| In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter. | ||||
| CVE-2019-11025 | 2 Cacti, Debian | 2 Cacti, Debian Linux | 2024-11-21 | 5.4 Medium |
| In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache, leading to XSS. | ||||
| CVE-2018-20726 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices. | ||||
| CVE-2018-20725 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label. | ||||
| CVE-2018-20724 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors. | ||||
| CVE-2018-20723 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color. | ||||
| CVE-2018-10061 | 2 Cacti, Debian | 2 Cacti, Debian Linux | 2024-11-21 | 5.4 Medium |
| Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls occur when the html_escape function in lib/html.php is not used). | ||||
| CVE-2018-10060 | 2 Cacti, Debian | 2 Cacti, Debian Linux | 2024-11-21 | 5.4 Medium |
| Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php. | ||||
| CVE-2018-10059 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] instead of $_SERVER['SCRIPT_NAME'] to determine a page name. | ||||
| CVE-2017-16785 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php. | ||||
| CVE-2017-16661 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd. | ||||
| CVE-2017-16660 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header. | ||||
| CVE-2017-16641 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php. | ||||
| CVE-2017-15194 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page. | ||||
| CVE-2017-12978 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user. | ||||
| CVE-2017-12927 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php. | ||||
| CVE-2017-12066 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163. | ||||
| CVE-2017-12065 | 1 Cacti | 1 Cacti | 2024-11-21 | N/A |
| spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter. | ||||