Page 8 of 134 results (0.013 seconds)

CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0

CVE-2017-12065 – Gentoo Linux Security Advisory 201711-10

https://notcve.org/view.php?id=CVE-2017-12065

01 Aug 2017 — spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter. spikekill.php en Cacti en versiones anteriores a la 1.1.16 puede permitir a los atacantes remotos ejecutar código arbitrario mediante el parámetro avgnan, outlier-start o outlier-end. Multiple vulnerabilities have been found in Cacti, the worst of which could lead to the remote execution of arbitrary code. Versions less than 1.1.20:1.1.20 are affected. • http://www.securityfocus.com/bid/100080 •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-12066

https://notcve.org/view.php?id=CVE-2017-12066

01 Aug 2017 — Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. NOTE: this vulnerability exists because of an incomplete fix (lack of the htmlspecialchars ENT_QUOTES flag) for CVE-2017-11163. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en aggregate_graphs.php en Cacti en versiones anteriores a la 1.1.16 permite que los usu... • https://cacti.net/release_notes.php?version=1.1.16 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-11691

https://notcve.org/view.php?id=CVE-2017-11691

27 Jul 2017 — Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers. La vulnerabilidad de tipo cross-site-scripting (XSS) en el archivo auth_profile.php en Cacti versión 1.1.13, permite a los atacantes remotos inyectar scripts web o HTML arbitrarios por medio de encabezados Referer HTTP especialmente creados. • http://www.securityfocus.com/bid/100022 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-1000032

https://notcve.org/view.php?id=CVE-2017-1000032

13 Jul 2017 — Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.php and drp_action parameter to data_sources.php. Una vulnerabilidad de tipo Cross-Site scripting (XSS) en cactus versión 0.8.8b, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro parent_id en archivo tree.php y parámetro drp_action en archivo data_sources.php. • https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-007 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-1000031

https://notcve.org/view.php?id=CVE-2017-1000031

13 Jul 2017 — SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters. Una vulnerabilidad de inyección SQL en el archivo graph_templates_inputs.php en Cacti versión 0.8.8b, permite a atacantes remotos ejecutar comandos SQL arbitrarios por medio de los parámetros graph_template_input_id y graph_template_id. • https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-007/?fid=7789 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-11163

https://notcve.org/view.php?id=CVE-2017-11163

10 Jul 2017 — Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable. Una vulnerabilidad de Cross-Site Scripting (XSS) en aggregate_graphs.php en Cacti versión 1.1.12, permite a los usuarios autenticados a distancia inyectar secuencias de comandos web arbitrarias o HTML mediante cabeceras de referencia HTTP especialmente diseñadas, relacionadas ... • http://www.securitytracker.com/id/1038908 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-10970

https://notcve.org/view.php?id=CVE-2017-10970

06 Jul 2017 — Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php. Una vulnerabilidad de Cross-Site Scripting (XSS) en link.php en Cacti 1.1.12 permite que usuarios remotos anónimos inyecten scripts web o HTML arbitrarios mediante el parámetro id, relacionado con la función die_html_input_error en lib/html_validate.php. • http://www.securitytracker.com/id/1038908 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0

CVE-2016-2313 – Gentoo Linux Security Advisory 201711-10

https://notcve.org/view.php?id=CVE-2016-2313

13 Apr 2016 — auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti database. auth_logen.php en Cacti en versiones anteriores a 0.8.8g permite a usuarios remotos autenticados que utilizan autenticación web eludir las restricciones destinadas al acceso iniciando sesión como un usuario que no está en la base de datos cacti. Multiple vulnerabilities have been found in Cacti, the worst of which could l... • http://bugs.cacti.net/view.php?id=2656 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2016-3172

https://notcve.org/view.php?id=CVE-2016-3172

12 Apr 2016 — SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id parameter in an item_edit action. Vulnerabilidad de inyección SQL en tree.php en Cacti 0.8.8g y versiones anteriores permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro parent_id en una acción item_edit action. • http://bugs.cacti.net/view.php?id=2667 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 4

CVE-2016-3659 – Cacti 0.8.8g SQL Injection

https://notcve.org/view.php?id=CVE-2016-3659

05 Apr 2016 — SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter. Vulnerabilidad de inyección SQL en graph_view.php en Cacti 0.8.8.g permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro host_group_data. • https://packetstorm.news/files/id/136547 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •