CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4454
https://notcve.org/view.php?id=CVE-2015-4454
SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. Vulnerabilidad de inyección SQL en la función get_hash_graph_template en lib/functions.php en Cacti anterior a 0.8.8d permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro graph_template_id en graph_templates.php. • http://bugs.cacti.net/view.php?id=2572 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://www.cacti.net/release_notes_0_8_8d.php http://www.debian.org/security/2015/dsa-3295 http://www.securityfocus.com/bid/75270 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2015-4342
https://notcve.org/view.php?id=CVE-2015-4342
SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id. Vulnerabilidad de inyección SQL en Cacti anterior a 0.8.8d permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados que involucran un id cdef. • http://bugs.cacti.net/view.php?id=2571 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183449.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183454.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183919.html http://lists.opensuse.org/opensuse-updates/2015-06/msg00052.html http://packetstormsecurity.com/files/132224/Cacti-SQL-Injection-Header-Injection.html http://seclists.org/fulldisclosure/2015/Jun/19 http://www.cacti.net/release&# • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-0916
https://notcve.org/view.php?id=CVE-2015-0916
SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035. Vulnerabilidad de inyección SQL en graph.php en Cacti anterior a 0.8.6f permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro local_graph_id, una vulnerabilidad diferente a CVE-2007-6035. • http://jvn.jp/en/jp/JVN18957556/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2015-000064 http://www.cacti.net/release_notes_0_8_6f.php • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 1%CPEs: 13EXPL: 0CVE-2014-5261
https://notcve.org/view.php?id=CVE-2014-5261
The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php. La secuencia de comandos de configuraciones gráficas (graph_settings.php) en Cacti 0.8.8b y anteriores permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres de shell en un tamaño de fuente, relacionado con la línea de comando rrdtool en lib/rrd.php. • http://seclists.org/oss-sec/2014/q3/351 http://seclists.org/oss-sec/2014/q3/386 http://svn.cacti.net/viewvc?view=rev&revision=7454 http://www.debian.org/security/2014/dsa-3007 http://www.securityfocus.com/bid/69213 https://bugzilla.redhat.com/show_bug.cgi?id=1127165 https://exchange.xforce.ibmcloud.com/vulnerabilities/95292 https://security.gentoo.org/glsa/201607-05 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2014-5262
https://notcve.org/view.php?id=CVE-2014-5262
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en la secuencia de comandos de configuraciones gráficas (graph_settings.php) en Cacti 0.8.8b y anteriores permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados. • http://seclists.org/oss-sec/2014/q3/351 http://seclists.org/oss-sec/2014/q3/386 http://svn.cacti.net/viewvc?view=rev&revision=7454 http://www.debian.org/security/2014/dsa-3007 http://www.securityfocus.com/bid/69213 https://bugzilla.redhat.com/show_bug.cgi?id=1127165 https://exchange.xforce.ibmcloud.com/vulnerabilities/95292 https://security.gentoo.org/glsa/201607-05 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •