CVSS: 10.0EPSS: 92%CPEs: 3EXPL: 2CVE-2023-39361 – Unauthenticated SQL Injection in graph_view.php in Cacti
https://notcve.org/view.php?id=CVE-2023-39361
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an enabled state, there could be the potential for significant damage. Attackers may exploit this vulnerability, and there may be possibilities for actions such as the usurpation of administrative privileges or remote code execution. This... • https://github.com/HPT-Intern-Task-Submission/CVE-2023-39361 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 2%CPEs: 3EXPL: 1CVE-2023-39360 – Reflected Cross-site Scripting in graphs_new.php in Cacti
https://notcve.org/view.php?id=CVE-2023-39360
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Several validations are performed, but the `returnto` parameter is directly passed to `form_save_button`. In order to bypass this validation, returnto must contain `host.php`. This vulnerability has been addressed in version 1.2.25. • https://github.com/Cacti/cacti/security/advisories/GHSA-gx8c-xvjh-9qh4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39366 – Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacti
https://notcve.org/view.php?id=CVE-2023-39366
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The `data_sources.php` script displays the data source management information (e.g. data source path, polling configuration etc.) for different d... • https://github.com/Cacti/cacti/security/advisories/GHSA-rwhh-xxm6-vcrv • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39510 – Stored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in Cacti
https://notcve.org/view.php?id=CVE-2023-39510
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The`reports_admin.php` script displays reporting information about graphs, devices, data sources etc. CENSUS found that an adversary that is able... • https://github.com/Cacti/cacti/security/advisories/GHSA-24w4-4hp2-3j8h • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39512 – Stored Cross-site Scripting on data_sources.php device name view in Cacti
https://notcve.org/view.php?id=CVE-2023-39512
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_sources.php` displays the data source management information (e.g. data source path, polling configuration, device n... • https://github.com/Cacti/cacti/security/advisories/GHSA-vqcc-5v63-g9q7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39513 – Stored Cross-site Scripting on host.php verbose data-query debug view in Cacti
https://notcve.org/view.php?id=CVE-2023-39513
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `host.php` is used to monitor and manage hosts in the _cacti_ app, hence displays useful information such as data queries ... • https://github.com/Cacti/cacti/security/advisories/GHSA-9fj7-8f2j-2rw2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 3EXPL: 1CVE-2023-39515 – Stored Cross-site Scripting on data_debug.php datasource path view in Cacti
https://notcve.org/view.php?id=CVE-2023-39515
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts and execute JavaScript code in the victim's browser at view-time. The script under `data_debug.php` displays data source related debugging information such as _data source paths, polling settings, meta-data on the d... • https://github.com/Cacti/cacti/security/advisories/GHSA-hrg9-qqqx-wc4h • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-39514 – Stored Cross-site Scripting on graphs.php data template formated name view in Cacti
https://notcve.org/view.php?id=CVE-2023-39514
05 Sep 2023 — Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrative _cacti_ accounts and execute JavaScript code in the victim's browser at view-time. The script under `graphs.php` displays graph details such as data-source paths, data template information and graph related fields. _CENSUS... • https://github.com/Cacti/cacti/security/advisories/GHSA-6hrc-2cfc-8hm7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-41444
https://notcve.org/view.php?id=CVE-2022-41444
22 Aug 2023 — Cross Site Scripting (XSS) vulnerability in Cacti 1.2.21 via crafted POST request to graphs_new.php. Vulnerabilidad de Cross Site Scripting (XSS) en Cacti 1.2.21 a través de una petición POST a graphs_new.php. • https://gist.github.com/enferas/9079535112e4f4ff2c1d2ce1c099d4c2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-48538
https://notcve.org/view.php?id=CVE-2022-48538
22 Aug 2023 — In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password. • https://docs.cacti.net/Settings-Auth-LDAP.md • CWE-863: Incorrect Authorization •