CVSS: 9.8EPSS: 0%CPEs: 37EXPL: 1CVE-2010-2092 – cacti: graph.php rra_id SQL injection vulnerability (MOPS-2010-023)
https://notcve.org/view.php?id=CVE-2010-2092
27 May 2010 — SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $_GET value into the resulting query. Vulnerabilidad de inyección SQL en graph.php en Cacti v0.8.7e y anteriores permite a atacntes remotos ejecutar comandos SQL de su elección ... • http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 37EXPL: 1CVE-2010-1431 – Cacti 0.8.7e - SQL Injection
https://notcve.org/view.php?id=CVE-2010-1431
04 May 2010 — SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter. Vulnerabilidad de inyección SQL en templates_export.php en Cacti v0.8.7e y anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro export_item_id. • https://www.exploit-db.com/exploits/12338 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 3%CPEs: 16EXPL: 3CVE-2009-4112 – Joomla! Component ProofReader 1.0 RC9 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-4112
30 Nov 2009 — Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands. Cacti v0.8.7e y anteriores permite a administradores remotos autenticados obtener privilegios modificando el "Data Input Method" (método de entrada de datos) para la opción "Linux - Get Memory Usage" (Linux - obtener utilización de la memoria) para contener comandos de su elección. • https://www.exploit-db.com/exploits/33377 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 5%CPEs: 1EXPL: 2CVE-2009-4032 – Cacti 0.8.x - 'graph.php' Multiple Cross-Site Scripting Vulnerabilities
https://notcve.org/view.php?id=CVE-2009-4032
27 Nov 2009 — Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) graph.php, (2) include/top_graph_header.php, (3) lib/html_form.php, and (4) lib/timespan_settings.php, as demonstrated by the (a) graph_end or (b) graph_start parameters to graph.php; (c) the date1 parameter in a tree action to graph_view.php; and the (d) page_refresh and (e) default_dual_pane_width parameters to graph_settings.php. Múltiples vulnerabil... • https://www.exploit-db.com/exploits/33374 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 16EXPL: 5CVE-2008-0785 – Cacti 0.8.7 - '/index.php/sql.php?Login Action login_username' SQL Injection
https://notcve.org/view.php?id=CVE-2008-0785
14 Feb 2008 — Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the (1) graph_list parameter to graph_view.php, (2) leaf_id and id parameters to tree.php, (3) local_graph_id parameter to graph_xport.php, and (4) login_username parameter to index.php/login. Múltiples vulnerabilidades de inyección SQL en Cacti 0.8.7 anterior a 0.8.7b y 0.8.6 anterior a 0.8.6k. que permite a usuarios autentificados remotamente ej... • https://www.exploit-db.com/exploits/31161 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 4%CPEs: 16EXPL: 3CVE-2008-0783 – Cacti 0.8.7 - 'graph_view.php?filter' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-0783
14 Feb 2008 — Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script or HTML via (1) the view_type parameter to graph.php; (2) the filter parameter to graph_view.php; (3) the action parameter to the draw_navigation_text function in lib/functions.php, reachable through index.php (aka the login page) or data_input.php; or (4) the login_username parameter to index.php. Múltiples vulnerabilidades de tipo cross-site scripti... • https://www.exploit-db.com/exploits/31158 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 1%CPEs: 16EXPL: 1CVE-2008-0784
https://notcve.org/view.php?id=CVE-2008-0784
14 Feb 2008 — graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows remote attackers to obtain the full path via an invalid local_graph_id parameter and other unspecified vectors. Graph.php en Cacti 0.8.7 anterior a 0.8.7b y 0.8.6 anterior a 0.8.6k, permite a atacantes remotos obtener la ruta completa a través de un parámetro local_graph_id inválido y otros vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.7EPSS: 0%CPEs: 16EXPL: 0CVE-2008-0786
https://notcve.org/view.php?id=CVE-2008-0786
14 Feb 2008 — CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Vulnerabilidad de inyección CRLF en Cacti 0.8.7 anterior a 0.8.7b y 0.8.6 anterior a 0.8.6k, cuando se ejecuta en intérpretes PHP antiguos, permite a atacantes remotos inyectar cabeceras HTTP de su elección y llevar a cabo ataques de división de respuesta HTTP a ... • http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 4%CPEs: 1EXPL: 0CVE-2007-6035
https://notcve.org/view.php?id=CVE-2007-6035
20 Nov 2007 — SQL injection vulnerability in graph.php in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter. Una vulnerabilidad de inyección SQL en el archivo graph.php en Cacti versiones anteriores a 0.8.7a, permite a atacantes remotos ejecutar comandos SQL arbitrarios por medio del parámetro local_graph_id. • http://bugs.gentoo.org/show_bug.cgi?id=199509 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 4%CPEs: 1EXPL: 0CVE-2007-3112
https://notcve.org/view.php?id=CVE-2007-3112
07 Jun 2007 — graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113. Cacti 0.8.6i y, posiblemente otras versiones, permite a usuarios remotos autenticados provocar una denegación de servicio (agotamiento de CPU) mediante un valor largo en los parámetros (1) graph_start o (2) graph_end. • http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0074.html •