CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11163
https://notcve.org/view.php?id=CVE-2017-11163
Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. Una vulnerabilidad de Cross-Site Scripting (XSS) en aggregate_graphs.php en Cacti versión 1.1.12, permite a los usuarios autenticados a distancia inyectar secuencias de comandos web arbitrarias o HTML mediante cabeceras de referencia HTTP especialmente diseñadas, relacionadas con la variable $cancel_url. • http://www.securitytracker.com/id/1038908 https://github.com/Cacti/cacti/issues/847 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10970
https://notcve.org/view.php?id=CVE-2017-10970
Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php. Una vulnerabilidad de Cross-Site Scripting (XSS) en link.php en Cacti 1.1.12 permite que usuarios remotos anónimos inyecten scripts web o HTML arbitrarios mediante el parámetro id, relacionado con la función die_html_input_error en lib/html_validate.php. • http://www.securitytracker.com/id/1038908 https://github.com/Cacti/cacti/issues/838 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •