CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2020-14424 – Gentoo Linux Security Advisory 202412-02
https://notcve.org/view.php?id=CVE-2020-14424
14 Nov 2021 — Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme. Cacti versiones anteriores a 1.2.18, permite a atacantes remotos desencadenar un ataque de tipo XSS por medio de la importación de plantillas para el tema midwinter Multiple vulnerabilities have been discovered in Cacti, the worst of which can lead to privilege escalation. Versions greater than or equal to 1.2.26 are affected. • https://bugzilla.redhat.com/show_bug.cgi?id=2001016 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 1CVE-2020-23226
https://notcve.org/view.php?id=CVE-2020-23226
27 Aug 2021 — Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.php, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, and (7) data_input.php. Se presentan múltiples vulnerabilidades de tipo Cross Site Scripting (XSS) en Cacti versión 1.2.12, en los archivos (1) reports_admin.php, (2) data_queries.php, (3) datat.ph_inpup, (4) graph_templates.php, (5) graphs.php, (6) reports_admin.php, y (7) data_input.php • https://github.com/Cacti/cacti/issues/3549 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 2%CPEs: 4EXPL: 1CVE-2020-35701 – Gentoo Linux Security Advisory 202101-31
https://notcve.org/view.php?id=CVE-2020-35701
11 Jan 2021 — An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution. Se detectó un problema en Cacti versiones 1.2.x hasta 1.2.16. Una vulnerabilidad de inyección SQL en el archivo data_debug.php permite a atacantes autenticados remotos ejecutar comandos SQL arbitrarios por medio del parámetro site_id. • https://asaf.me/2020/12/15/cacti-1-2-0-to-1-2-16-sql-injection • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2CVE-2020-25706
https://notcve.org/view.php?id=CVE-2020-25706
12 Nov 2020 — A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field Se presenta una vulnerabilidad de tipo cross-site scripting (XSS) en el archivo templates_import.php (Cacti versión 1.2.13) debido al escape inapropiado del mensaje de error durante la vista previa de la importación de la plantilla en el campo xml_path • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25706 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 85%CPEs: 3EXPL: 8CVE-2020-14295 – Cacti 1.2.12 - 'filter' SQL Injection
https://notcve.org/view.php?id=CVE-2020-14295
17 Jun 2020 — A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries. Un problema de inyección SQL en el archivo color.php en Cacti versión 1.2.12, permite a un administrador inyectar SQL por medio del parámetro filter. Esto puede conllevar a una ejecución de comandos remota porque el producto acepta consultas en pila Multiple vulnerabilities have been found in Cacti, the worst of whic... • https://packetstorm.news/files/id/162918 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-13231
https://notcve.org/view.php?id=CVE-2020-13231
20 May 2020 — In Cacti before 1.2.11, auth_profile.php?action=edit allows CSRF for an admin email change. En Cacti versiones anteriores a 1.2.11, auth_profile.php?action=edit permite un ataque de tipo CSRF para un cambio de correo electrónico de administrador. • https://github.com/Cacti/cacti/issues/3342 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 1CVE-2020-13230
https://notcve.org/view.php?id=CVE-2020-13230
20 May 2020 — In Cacti before 1.2.11, disabling a user account does not immediately invalidate any permissions granted to that account (e.g., permission to view logs). En Cacti versiones anteriores a 1.2.11, deshabilita una cuenta de usuario que no invalida inmediatamente los permisos concedidos a dicha cuenta (por ejemplo, el permiso para visualizar los registros). • https://github.com/Cacti/cacti/issues/3343 • CWE-281: Improper Preservation of Permissions •
CVSS: 9.3EPSS: 76%CPEs: 8EXPL: 14CVE-2020-8813 – Cacti 1.2.8 - Unauthenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-8813
22 Feb 2020 — graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege. El archivo graph_realtime.php en Cacti versión 1.2.8, permite a atacantes remotos ejecutar comandos arbitrarios de Sistema Operativo por medio de metacaracteres de shell en una cookie, si un usuario invitado posee el privilegio graph real-time. graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS comma... • https://packetstorm.news/files/id/156538 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 7%CPEs: 1EXPL: 1CVE-2020-7237 – Gentoo Linux Security Advisory 202003-40
https://notcve.org/view.php?id=CVE-2020-7237
20 Jan 2020 — Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product. Cacti versión 1.2.8, permite una ejecución de código remota (por parte de usuarios privilegiados) por medio de metacaracteres de shell en el campo Performance Boost Debug Log del archivo polle... • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17357 – Debian Security Advisory 4604-1
https://notcve.org/view.php?id=CVE-2019-17357
19 Jan 2020 — Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery. Cacti versiones hasta 1.2.7, está afectado por una vulnerabilidad de inyección SQL de graphs.php?template_id= afectando la fo... • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00001.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •