120 results · Feed
-
Unscored —
An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote au…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of er…
-
Unscored —
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lea…
-
Unscored —
In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change.
-
Unscored —
In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that accoun…
-
Unscored —
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in …
-
Unscored —CVE-2019-17357 EPSS 34%
Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identif…
-
Unscored —CVE-2020-7237 EPSS 37%
Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug …
-
Unscored —
Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automati…
-
Unscored —
Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled da…
-
Unscored —
In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_js…
-
Unscored —
In clearFilter() in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP c…
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping …
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escap…
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping …
-
Unscored —
A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unint…
-
Unscored —
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_u…
-
Unscored —
Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls oc…
-
Unscored —
auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended ac…
-
Unscored —
Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP …
-
Unscored —
lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rr…
-
Unscored —
Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTM…
-
Unscored —
SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary …
-
Unscored —
auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended a…
-
Unscored —
SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitr…
-
Unscored —
SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote…
-
Unscored —
SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary S…
-
Unscored —
SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to exec…
-
Unscored —
SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows r…
-
Unscored —
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL comma…
-
Unscored —
Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbit…
-
Unscored —
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows …
-
Unscored —
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspec…
-
Unscored —
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script …
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console acces…
-
Unscored —
Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with con…
-
Unscored —CVE-2014-5261 EPSS 11%
The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary…
-
Unscored —
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web scri…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack …