CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2018-10060
https://notcve.org/view.php?id=CVE-2018-10060
12 Apr 2018 — Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_uri function in lib/functions.php. Cacti, en versiones anteriores a la 1.1.37, tiene Cross-Site Scripting (XSS) debido a que no rechaza correctamente los caracteres no deseados. Esto se relaciona con el uso de la función sanitize_uri en lib/functions.php. • http://www.securitytracker.com/id/1040620 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10700
https://notcve.org/view.php?id=CVE-2016-10700
24 Nov 2017 — auth_login.php in Cacti before 1.0.0 allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database, because the guest user is not considered. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-2313. auth_login.php en versiones anteriores a la 1.0.0 de Cacti permite que usuarios autenticados remotos que emplean la autenticación web omitan las restricciones de acceso planeadas iniciando sesión como u... • http://bugs.cacti.net/view.php?id=2697 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4000 – Gentoo Linux Security Advisory 201711-10
https://notcve.org/view.php?id=CVE-2014-4000
13 Nov 2017 — Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()). Cacti en versiones anteriores a la 1.0.0 permite que usuarios remotos autenticados lleven a cabo ataques de inyección de objetos PHP y ejecuten código PHP arbitrario mediante un objeto serializado manipulado, relacionado con la llamada a unserialize(stripslashes()). Multiple vulnerabilities have been found... • https://forums.cacti.net/viewtopic.php?f=4&t=56794 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16785
https://notcve.org/view.php?id=CVE-2017-16785
10 Nov 2017 — Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php. Cacti 1.1.27 tiene XSS reflejado mediante PATH_INFO en host.php. • http://www.securitytracker.com/id/1039774 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16661
https://notcve.org/view.php?id=CVE-2017-16661
08 Nov 2017 — Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd. Cacti 1.1.27 permite que administradores remotos autenticados lean archivos arbitrarios colocando la ruta de acceso a registros en un directorio privado y, a continuación, realizando una petición clog.php?filename=, tal y como demuestra filename=passw... • https://github.com/Cacti/cacti/issues/1066 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16660
https://notcve.org/view.php?id=CVE-2017-16660
08 Nov 2017 — Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header. La versión 1.1.27 de Cacti permite que administradores remotos autenticados lleven a cabo ataques de ejecución remota de código colocando la ruta de acceso a registros bajo la raíz web y, a continuación, realizando una petición remote_agent-php que contenga código PHP en una cabecera ... • https://github.com/Cacti/cacti/issues/1066 • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16641
https://notcve.org/view.php?id=CVE-2017-16641
07 Nov 2017 — lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php. lib/rrd.php en Cacti 1.1.27 permite que administradores remotos autenticados ejecuten comandos de sistema operativo arbitrarios mediante el parámetro path_rrdtool en una petición action=save en settings.php. • https://github.com/Cacti/cacti/issues/1057 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-15194
https://notcve.org/view.php?id=CVE-2017-15194
10 Oct 2017 — include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page. include/global_session.php en Cacti 1.1.25 tiene XSS relacionado con (1) la URI o (2) la acción refresh page. • http://www.securitytracker.com/id/1039569 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12978
https://notcve.org/view.php?id=CVE-2017-12978
21 Aug 2017 — lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user. lib/html.php en Cacti en versiones anteriores a la 1.1.18 tiene una vulnerabilidad de tipo Cross-Site Scripting (XSS) que se puede producir mediante el campo de título de un enlace externo añadido por un usuario autenticado. • http://www.securitytracker.com/id/1039226 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-12927
https://notcve.org/view.php?id=CVE-2017-12927
18 Aug 2017 — A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php. Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en Cacti 1.1.17 en el parámetro method en spikekill.php. • http://www.securityfocus.com/bid/100490 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •