175 results · Feed
-
Unscored —
An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote au…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of er…
-
Unscored —
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lea…
-
Unscored —
In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.
-
Unscored —
In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that accoun…
-
Unscored —
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in …
-
Unscored —CVE-2019-17357 EPSS 34%
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identif…
-
Unscored —CVE-2020-7237 EPSS 37%
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug …
-
Unscored —
Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automati…
-
Unscored —
data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input …
-
Unscored —
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled da…
-
Unscored —
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_js…
-
Unscored —
In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP c…
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping …
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escap…
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping …
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unint…
-
Unscored —
Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] i…
-
Unscored —
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_u…
-
Unscored —
Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls oc…
-
Unscored —
auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended ac…
-
Unscored —
Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP …
-
Unscored —
-
Unscored —
Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Pat…
-
Unscored —
Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private …
-
Unscored —
lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rr…
-
Unscored —
include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.
-
Unscored —
lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user.
-
Unscored —
A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.
-
Unscored —
spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-sta…
-
Unscored —
Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated use…
-
Unscored —
Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrar…
-
Unscored —
Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTM…
-
Unscored —
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary …
-
Unscored —
Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to i…
-
Unscored —
Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary …
-
Unscored —
auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended a…
-
Unscored —
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitr…
-
Unscored —
SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote…
-
Unscored —
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary S…