CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 2CVE-2015-8369 – Cacti 0.8.8f SQL Injection
https://notcve.org/view.php?id=CVE-2015-8369
SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php. Vulnerabilidad de inyección SQL en include/top_graph_header.php en Cacti 0.8.8f y en versiones anteriores permite a atacantes remotos ejecutar comandosSQL arbitrarios a través del parámetro rra_id en una acción de propiedades en graph.php. Cacti versions 0.8.8f and below suffer from a remote SQL injection vulnerability. • http://bugs.cacti.net/view.php?id=2646 http://packetstormsecurity.com/files/134724/Cacti-0.8.8f-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Dec/8 http://www.debian.org/security/2015/dsa-3423 http://www.securitytracker.com/id/1034497 https://security.gentoo.org/glsa/201607-05 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2015-4634
https://notcve.org/view.php?id=CVE-2015-4634
SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter. Vulnerabilidad de inyección SQL en graphs.php en Cacti en versiones anteriores a 0.8.8e, lo que permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro local_graph_id. • http://bugs.cacti.net/view.php?id=2577 http://lists.opensuse.org/opensuse-updates/2015-07/msg00052.html http://www.cacti.net/release_notes_0_8_8e.php http://www.debian.org/security/2015/dsa-3312 http://www.securitytracker.com/id/1032989 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2967
https://notcve.org/view.php?id=CVE-2015-2967
Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en settings.php en Cacti en versiones anteriores a la 0.8.8d, permite a los atacantes inyectar secuencias de comandos web arbitrarios o HTML a través de vectores inespecíficos. • http://jvn.jp/en/jp/JVN78187936/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000094 http://www.cacti.net/release_notes_0_8_8d.php http://www.securitytracker.com/id/1032672 https://security.gentoo.org/glsa/201509-03 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4454
https://notcve.org/view.php?id=CVE-2015-4454
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. Vulnerabilidad de inyección SQL en la función get_hash_graph_template en lib/functions.php en Cacti anterior a 0.8.8d permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro graph_template_id en graph_templates.php. • http://bugs.cacti.net/view.php?id=2572 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://www.cacti.net/release_notes_0_8_8d.php http://www.debian.org/security/2015/dsa-3295 http://www.securityfocus.com/bid/75270 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2015-2665
https://notcve.org/view.php?id=CVE-2015-2665
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Cacti anterior a 0.8.8d permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://www.cacti.net/release_notes_0_8_8d.php http://www.debian.org/security/2015/dsa-3295 http://www.fortiguard.com/advisory/FG-VD-15-017 http://www.securityfocus.com/bid/75309 http://www.securitytracker.com/id/1032672 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •