CVSS: 8.3EPSS: 16%CPEs: 3EXPL: 6CVE-2023-39362 – Authenticated command injection in SNMP options of a Device
https://notcve.org/view.php?id=CVE-2023-39362
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addr... • https://packetstorm.news/files/id/175029 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39364 – Open redirect in change password functionality in Cacti
https://notcve.org/view.php?id=CVE-2023-39364
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` as a URL parameter and reflects it in the form used to perform the change password. It's value is used to perform a redirect via `header` PHP function. A user can be tricked in performing the change password operation, e.g., via a ph... • https://github.com/Cacti/cacti/security/advisories/GHSA-4pjv-rmrp-r59x • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39516 – Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacti
https://notcve.org/view.php?id=CVE-2023-39516
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration etc.) for... • https://github.com/Cacti/cacti/security/advisories/GHSA-r8qq-88g3-hmgv • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39365 – Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti
https://notcve.org/view.php?id=CVE-2023-39365
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/Cacti/cacti/security/advisories/GHSA-v5w7-hww7-2f22 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39357 – A Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in Cacti
https://notcve.org/view.php?id=CVE-2023-39357
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save function do not perform prior validation of user input, leading to the existence of multiple SQL injection vulnerabilities in Cacti. This allows authenticated users to exploit these SQL injection vulnerabilities to perform privilege escalation and remo... • https://github.com/Cacti/cacti/security/advisories/GHSA-6jhp-mgqg-fhqg • CWE-20: Improper Input Validation CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39358 – Authenticated SQL injection vulnerability in reports_user.php in Cacti
https://notcve.org/view.php?id=CVE-2023-39358
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.php` file. In `ajax_get_branches`, the `tree_id` parameter is passed to the `reports_get_branch_select` function without any validation. This issue has been addressed in version 1.2.25. • https://github.com/Cacti/cacti/security/advisories/GHSA-gj95-7xr8-9p7g • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39359 – Authenticated SQL injection vulnerability in graphs.php in Cacti
https://notcve.org/view.php?id=CVE-2023-39359
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` file. When dealing with the cases of ajax_hosts and ajax_hosts_noany, if the `site_id` parameter is greater than 0, it is directly reflected in the WHERE clause of the SQL statement. This creates an SQL injection vulnerability. • https://github.com/Cacti/cacti/security/advisories/GHSA-q4wh-3f9w-836h • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 6%CPEs: 3EXPL: 2CVE-2023-39361 – Unauthenticated SQL Injection in graph_view.php in Cacti
https://notcve.org/view.php?id=CVE-2023-39361
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This... • https://github.com/HPT-Intern-Task-Submission/CVE-2023-39361 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39360 – Reflected Cross-site Scripting in graphs_new.php in Cacti
https://notcve.org/view.php?id=CVE-2023-39360
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Several validations are performed, but the `returnto` parameter is directly passed to `form_save_button`. In order to bypass this validation, returnto must contain `host.php`. This vulnerability has been addressed in version 1.2.25. • https://github.com/Cacti/cacti/security/advisories/GHSA-gx8c-xvjh-9qh4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39366 – Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti
https://notcve.org/view.php?id=CVE-2023-39366
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different d... • https://github.com/Cacti/cacti/security/advisories/GHSA-rwhh-xxm6-vcrv • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •