Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 10 | cacti | 1.2.2+ds1-2+deb10u6 |
Vulnerabilities 13
-
Critical 9.8
Unauthenticated SQL Injection in graph_view.php in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are bei…
-
High 8.8
A Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in Cacti
Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save…
-
High 8.8
Cacti SQL Injection vulnerability
Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable …
-
High 8.1
Local File Inclusion (RCE) in Cacti
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on th…
-
High 7.2
Authenticated command injection in SNMP options of a Device
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining …
-
Medium 6.1
Reflected Cross-site Scripting in graphs_new.php in Cacti
Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Sever…
-
Medium 6.1
Stored Cross-site Scripting on host.php verbose data-query debug view in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data wi…
-
Medium 6.1
Stored Cross-site Scripting on data_debug.php datasource path view in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be vi…
-
Medium 6.1
Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data wi…
-
Medium 6.1
Cacti has incomplete fix for CVE-2023-39515
Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse …
-
Medium 5.4
Cacti is vulnerable to cross-Site scripting (XSS) DOM
Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation…
-
Medium 4.6
Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti
Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been address…
-
Low 3.5
Open redirect in change password functionality in Cacti
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php`…