CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-2967
https://notcve.org/view.php?id=CVE-2015-2967
Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en settings.php en Cacti en versiones anteriores a la 0.8.8d, permite a los atacantes inyectar secuencias de comandos web arbitrarios o HTML a través de vectores inespecíficos. • http://jvn.jp/en/jp/JVN78187936/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000094 http://www.cacti.net/release_notes_0_8_8d.php http://www.securitytracker.com/id/1032672 https://security.gentoo.org/glsa/201509-03 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4454
https://notcve.org/view.php?id=CVE-2015-4454
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. Vulnerabilidad de inyección SQL en la función get_hash_graph_template en lib/functions.php en Cacti anterior a 0.8.8d permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro graph_template_id en graph_templates.php. • http://bugs.cacti.net/view.php?id=2572 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://www.cacti.net/release_notes_0_8_8d.php http://www.debian.org/security/2015/dsa-3295 http://www.securityfocus.com/bid/75270 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2015-2665
https://notcve.org/view.php?id=CVE-2015-2665
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Cacti anterior a 0.8.8d permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://www.cacti.net/release_notes_0_8_8d.php http://www.debian.org/security/2015/dsa-3295 http://www.fortiguard.com/advisory/FG-VD-15-017 http://www.securityfocus.com/bid/75309 http://www.securitytracker.com/id/1032672 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4342
https://notcve.org/view.php?id=CVE-2015-4342
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id. Vulnerabilidad de inyección SQL en Cacti anterior a 0.8.8d permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados que involucran un id cdef. • http://bugs.cacti.net/view.php?id=2571 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://lists.opensuse.org/opensuse-updates/2015-06/msg00052.html http://packetstormsecurity.com/files/132224/Cacti-SQL-Injection-Header-Injection.html http://seclists.org/fulldisclosure/2015/Jun/19 http://www.cacti.net/release&# • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0916
https://notcve.org/view.php?id=CVE-2015-0916
SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035. Vulnerabilidad de inyección SQL en graph.php en Cacti anterior a 0.8.6f permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro local_graph_id, una vulnerabilidad diferente a CVE-2007-6035. • http://jvn.jp/en/jp/JVN18957556/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000064 http://www.cacti.net/release_notes_0_8_6f.php • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •