cacti - security update

Fixed packages 2

Vulnerabilities 6

• High 8.8
  CVE-2023-49085 Public exploit EPSS 74%

  Cacti SQL Injection vulnerability

  Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable …

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  Dec 22, 2023
• High 8.1
  CVE-2023-49084 Public exploit EPSS 64%

  Local File Inclusion (RCE) in Cacti

  Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on th…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  Dec 21, 2023
• Medium 6.1
  CVE-2023-39360

  Reflected Cross-site Scripting in graphs_new.php in Cacti

  Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Sever…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  Sep 5, 2023
• Medium 6.1
  CVE-2023-39513

  Stored Cross-site Scripting on host.php verbose data-query debug view in Cacti

  Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data wi…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  Sep 5, 2023
• Medium 6.1
  CVE-2023-49088

  Cacti has incomplete fix for CVE-2023-39515

  Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse …

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  Dec 22, 2023
• Medium 5.4
  CVE-2023-49086

  Cacti is vulnerable to cross-Site scripting (XSS) DOM

  Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database (TSDB). A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation…

  Cacti cacti cacti cacti Debian Ubuntu Alpine
  Dec 21, 2023