Page 10 of 50 results (0.010 seconds)

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1

CVE-2018-10059

https://notcve.org/view.php?id=CVE-2018-10059

Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] instead of $_SERVER['SCRIPT_NAME'] to determine a page name. Cacti, en versiones anteriores a la 1.1.37, tiene Cross-Site Scripting (XSS) debido a que la función get_current_page en lib/functions.php depende de $_SERVER['PHP_SELF'] en lugar de $_SERVER['SCRIPT_NAME'] para determinar un nombre de página. • http://www.securitytracker.com/id/1040620 https://github.com/Cacti/cacti/issues/1457 https://www.cacti.net/changelog.php • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-16785

https://notcve.org/view.php?id=CVE-2017-16785

Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php. Cacti 1.1.27 tiene XSS reflejado mediante PATH_INFO en host.php. • http://www.securitytracker.com/id/1039774 https://github.com/Cacti/cacti/issues/1071 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-16660

https://notcve.org/view.php?id=CVE-2017-16660

Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header. La versión 1.1.27 de Cacti permite que administradores remotos autenticados lleven a cabo ataques de ejecución remota de código colocando la ruta de acceso a registros bajo la raíz web y, a continuación, realizando una petición remote_agent-php que contenga código PHP en una cabecera Client-ip. • https://github.com/Cacti/cacti/issues/1066 • CWE-668: Exposure of Resource to Wrong Sphere •

CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-16661

https://notcve.org/view.php?id=CVE-2017-16661

Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd. Cacti 1.1.27 permite que administradores remotos autenticados lean archivos arbitrarios colocando la ruta de acceso a registros en un directorio privado y, a continuación, realizando una petición clog.php?filename=, tal y como demuestra filename=passwd (con una ruta de acceso a registros bajo /etc) para leer /etc/passwd. • https://github.com/Cacti/cacti/issues/1066 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-16641

https://notcve.org/view.php?id=CVE-2017-16641

lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php. lib/rrd.php en Cacti 1.1.27 permite que administradores remotos autenticados ejecuten comandos de sistema operativo arbitrarios mediante el parámetro path_rrdtool en una petición action=save en settings.php. • https://github.com/Cacti/cacti/issues/1057 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •