CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 1CVE-2010-2543 – Cacti 0.8.7e - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2010-2543
Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en include/top_graph_header.php en Cacti antes de v0.8.7g permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro graph_start a graph.php. NOTA: esta vulnerabilidad existe debido a una solución incorrecta de la vulnerabilidad CVE-2009-4032.2.b. • https://www.exploit-db.com/exploits/10234 http://cacti.net/release_notes_0_8_7g.php http://marc.info/?l=oss-security&m=127978954522586&w=2 http://marc.info/?l=oss-security&m=128017203704299&w=2 http://svn.cacti.net/viewvc/cacti/branches/0.8.7/include/top_graph_header.php?r1=6025&r2=6024 http://svn.cacti.net/viewvc?view=rev&revision=6025 http://www.mandriva.com/security/advisories? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 37EXPL: 0CVE-2010-1644 – cacti: XSS issues in host.php and data_sources.php (VUPEN/ADV-2010-1203)
https://notcve.org/view.php?id=CVE-2010-1644
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) hostname or (2) description parameter to host.php, or (3) the host_id parameter to data_sources.php. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Cacti antes de v0.8.7f, tal como se utiliza en Red Hat High Performance Computing (HPC) Solution y otros productos, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de los parámetros a host.php (1) hostname o (2) description , o (3) el parámetro host_id a data_sources.php. • http://secunia.com/advisories/41041 http://svn.cacti.net/viewvc?view=rev&revision=5901 http://www.cacti.net/release_notes_0_8_7f.php http://www.mandriva.com/security/advisories?name=MDVSA-2010:160 http://www.securityfocus.com/archive/1/511393 http://www.securityfocus.com/bid/40332 http://www.vupen.com/english/advisories/2010/1203 http://www.vupen.com/english/advisories/2010/2132 https://bugzilla.redhat.com/show_bug.cgi?id=609093 https://rhn.redhat.com/errata/RHSA • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 1CVE-2010-2545 – cacti: XSS via various object names or descriptions
https://notcve.org/view.php?id=CVE-2010-2545
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_template.php, (20) lib/html.php, (21) lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php, and (25) user_admin.php. Múltiples vulnerabilidades de ejecución de comandos en sitios crtuzados (XSS) en Cacti antes de v0.8.7g, tal como se utiliza en Red Hat High Performance Computing (HPC) Solution y otros productos, permite a atacantes remotos inyectar HTML o secuencias de comandos web a través del (1) elemento name en una plantilla XML para templates_import.php. También permite a los administradores remotos autenticados inyectar secuencias de comandos web o HTML a través de vectores relacionados con (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources. php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php , (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_template.php, (20) lib/html.php, (21) lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php, y (25) user_admin.php. • http://cacti.net/release_notes_0_8_7g.php http://marc.info/?l=oss-security&m=127978954522586&w=2 http://marc.info/?l=oss-security&m=128017203704299&w=2 http://secunia.com/advisories/41041 http://svn.cacti.net/viewvc?view=rev&revision=6037 http://svn.cacti.net/viewvc?view=rev&revision=6038 http://svn.cacti.net/viewvc? • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 37EXPL: 1CVE-2010-2092 – cacti: graph.php rra_id SQL injection vulnerability (MOPS-2010-023)
https://notcve.org/view.php?id=CVE-2010-2092
SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $_GET value into the resulting query. Vulnerabilidad de inyección SQL en graph.php en Cacti v0.8.7e y anteriores permite a atacntes remotos ejecutar comandos SQL de su elección a través del parámetro rra_id en una petición GET en conjunción con un valor rra_id válido en una petición POST o una cooki, que supera la rutina de validación. • http://php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html http://secunia.com/advisories/41041 http://www.cacti.net/changelog.php http://www.debian.org/security/2010/dsa-2060 http://www.vupen.com/english/advisories/2010/2132 https://rhn.redhat.com/errata/RHSA-2010-0635.html https://access.redhat.com/security/cve/CVE-2010-2092 https://bugzilla.redhat.com/show_bug.cgi?id=609076 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 37EXPL: 1CVE-2010-1431 – Cacti 0.8.7e - SQL Injection
https://notcve.org/view.php?id=CVE-2010-1431
SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter. Vulnerabilidad de inyección SQL en templates_export.php en Cacti v0.8.7e y anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro export_item_id. • https://www.exploit-db.com/exploits/12338 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578909 http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html http://seclists.org/fulldisclosure/2010/Apr/272 http://secunia.com/advisories/39568 http://secunia.com/advisories/39572 http://secunia.com/advisories/41041 http://www.cacti.net/downloads/patches/0.8.7e/sql_injection_template_export.patch http://www.debian.org/security/2010/dsa-2039 http://www.exploit-d • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •