CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4454
https://notcve.org/view.php?id=CVE-2015-4454
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. Vulnerabilidad de inyección SQL en la función get_hash_graph_template en lib/functions.php en Cacti anterior a 0.8.8d permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro graph_template_id en graph_templates.php. • http://bugs.cacti.net/view.php?id=2572 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://www.cacti.net/release_notes_0_8_8d.php http://www.debian.org/security/2015/dsa-3295 http://www.securityfocus.com/bid/75270 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2015-2665
https://notcve.org/view.php?id=CVE-2015-2665
Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Cacti anterior a 0.8.8d permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores no especificados. • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://www.cacti.net/release_notes_0_8_8d.php http://www.debian.org/security/2015/dsa-3295 http://www.fortiguard.com/advisory/FG-VD-15-017 http://www.securityfocus.com/bid/75309 http://www.securitytracker.com/id/1032672 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4342
https://notcve.org/view.php?id=CVE-2015-4342
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id. Vulnerabilidad de inyección SQL en Cacti anterior a 0.8.8d permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados que involucran un id cdef. • http://bugs.cacti.net/view.php?id=2571 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://lists.opensuse.org/opensuse-updates/2015-06/msg00052.html http://packetstormsecurity.com/files/132224/Cacti-SQL-Injection-Header-Injection.html http://seclists.org/fulldisclosure/2015/Jun/19 http://www.cacti.net/release&# • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0916
https://notcve.org/view.php?id=CVE-2015-0916
SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035. Vulnerabilidad de inyección SQL en graph.php en Cacti anterior a 0.8.6f permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro local_graph_id, una vulnerabilidad diferente a CVE-2007-6035. • http://jvn.jp/en/jp/JVN18957556/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000064 http://www.cacti.net/release_notes_0_8_6f.php • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.5EPSS: 0%CPEs: 4EXPL: 2CVE-2014-5025
https://notcve.org/view.php?id=CVE-2014-5025
Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the name_cache parameter in a ds_edit action. Vulnerabilidad de XSS en data_sources.php en Cacti 0.8.8b permite a usuarios remotos autenticados con acceso a la consola inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro name_cache en una acción ds_edit. • http://bugs.cacti.net/view.php?id=2456 http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html http://www.debian.org/security/2014/dsa-3007 http://www.openwall.com/lists/oss-security/2014/07/22/9 http://www.securityfocus.com/bid/68759 https://exchange.xforce.ibmcloud.com/vulnerabilities/94814 https://security.gentoo.org/glsa/201509-03 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •