Page 11 of 94 results (0.010 seconds)

CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0

CVE-2017-12065

https://notcve.org/view.php?id=CVE-2017-12065

spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter. spikekill.php en Cacti en versiones anteriores a la 1.1.16 puede permitir a los atacantes remotos ejecutar código arbitrario mediante el parámetro avgnan, outlier-start o outlier-end. • http://www.securityfocus.com/bid/100080 https://cacti.net/release_notes.php?version=1.1.16 https://github.com/Cacti/cacti/commit/bd0e586f6f46d814930226f1516a194e7e72293e https://github.com/Cacti/cacti/issues/877 https://security.gentoo.org/glsa/201711-10 •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-12066

https://notcve.org/view.php?id=CVE-2017-12066

Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en aggregate_graphs.php en Cacti en versiones anteriores a la 1.1.16 permite que los usuarios remotos autenticados inyecten scripts web arbitrarios o HTML mediante cabeceras de referenciadores HTTP especialmente creadas en relación con la variable $cancel_url. NOTA: esta vulnerabilidad existe porque hay una parche incompleto (falta el flag htmlspecialchars ENT_QUOTES) para CVE-2017-11163. • https://cacti.net/release_notes.php?version=1.1.16 https://github.com/Cacti/cacti/commit/bd0e586f6f46d814930226f1516a194e7e72293e https://github.com/Cacti/cacti/issues/877 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2016-2313

https://notcve.org/view.php?id=CVE-2016-2313

auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database. auth_logen.php en Cacti en versiones anteriores a 0.8.8g permite a usuarios remotos autenticados que utilizan autenticación web eludir las restricciones destinadas al acceso iniciando sesión como un usuario que no está en la base de datos cacti. • http://bugs.cacti.net/view.php?id=2656 http://lists.opensuse.org/opensuse-updates/2016-02/msg00077.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00078.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00080.html http://www.cacti.net/release_notes_0_8_8g.php http://www.securitytracker.com/id/1037745 https://security.gentoo.org/glsa/201607-05 https://security.gentoo.org/glsa/201711-10 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2016-3172

https://notcve.org/view.php?id=CVE-2016-3172

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action. Vulnerabilidad de inyección SQL en tree.php en Cacti 0.8.8g y versiones anteriores permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro parent_id en una acción item_edit action. • http://bugs.cacti.net/view.php?id=2667 http://lists.opensuse.org/opensuse-updates/2016-05/msg00074.html http://www.openwall.com/lists/oss-security/2016/03/10/13 http://www.openwall.com/lists/oss-security/2016/03/15/11 http://www.securityfocus.com/bid/84324 https://security.gentoo.org/glsa/201607-05 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 3

CVE-2016-3659 – Cacti 0.8.8g SQL Injection

https://notcve.org/view.php?id=CVE-2016-3659

SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter. Vulnerabilidad de inyección SQL en graph_view.php en Cacti 0.8.8.g permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro host_group_data. • http://bugs.cacti.net/view.php?id=2673 http://lists.opensuse.org/opensuse-updates/2016-05/msg00074.html http://packetstormsecurity.com/files/136547/Cacti-0.8.8g-SQL-Injection.html http://seclists.org/fulldisclosure/2016/Apr/4 http://www.securityfocus.com/bid/85806 https://security.gentoo.org/glsa/201607-05 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •