CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 1CVE-2020-35701
https://notcve.org/view.php?id=CVE-2020-35701
An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution. Se detectó un problema en Cacti versiones 1.2.x hasta 1.2.16. Una vulnerabilidad de inyección SQL en el archivo data_debug.php permite a atacantes autenticados remotos ejecutar comandos SQL arbitrarios por medio del parámetro site_id. • https://asaf.me/2020/12/15/cacti-1-2-0-to-1-2-16-sql-injection https://github.com/Cacti/cacti/issues/4022 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DDD22Z56THHDTXAFM447UH3BVINURIF https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7DPUWZBAMCXFKAKUAJSHL3CKTOLGAK6 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBKBR2MFZJ6C2I4I5PCRR6UERPY24XZN https://security.gentoo.org/glsa/202101-31 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2CVE-2020-25706
https://notcve.org/view.php?id=CVE-2020-25706
A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo templates_import.php (Cacti versión 1.2.13) debido al escape inapropiado del mensaje de error durante la vista previa de la importación de la plantilla en el campo xml_path • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25706 https://github.com/Cacti/cacti/commit/39458efcd5286d50e6b7f905fedcdc1059354e6e https://github.com/Cacti/cacti/issues/3723 https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 32%CPEs: 3EXPL: 6CVE-2020-14295 – Cacti 1.2.12 - 'filter' SQL Injection
https://notcve.org/view.php?id=CVE-2020-14295
A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries. Un problema de inyección SQL en el archivo color.php en Cacti versión 1.2.12, permite a un administrador inyectar SQL por medio del parámetro filter. Esto puede conllevar a una ejecución de comandos remota porque el producto acepta consultas en pila • https://www.exploit-db.com/exploits/49810 https://github.com/0z09e/CVE-2020-14295 https://github.com/mrg3ntl3m4n/CVE-2020-14295 http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html http://packetstormsecurity.com/files/162918/Cacti-1.2.12-SQL-Injection-Remote-Command-Execution.html https://github.com/C • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-13231
https://notcve.org/view.php?id=CVE-2020-13231
In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change. En Cacti versiones anteriores a 1.2.11, auth_profile.php?action=edit permite un ataque de tipo CSRF para un cambio de correo electrónico de administrador. • https://github.com/Cacti/cacti/issues/3342 https://github.com/Cacti/cacti/releases/tag/release%2F1.2.11 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICJMWSY77IIGZYR6FE6NAQZFBO42VECO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3PCDGNELH7HEBIXRNT5J5EWQEXQAU6B • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2020-13230
https://notcve.org/view.php?id=CVE-2020-13230
In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs). En Cacti versiones anteriores a 1.2.11, deshabilita una cuenta de usuario que no invalida inmediatamente los permisos concedidos a dicha cuenta (por ejemplo, el permiso para visualizar los registros). • https://github.com/Cacti/cacti/issues/3343 https://github.com/Cacti/cacti/releases/tag/release%2F1.2.11 https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICJMWSY77IIGZYR6FE6NAQZFBO42VECO https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3PCDGNELH7HEBIXRNT5J5EWQEXQAU6B • CWE-281: Improper Preservation of Permissions •