Cacti
Page 2 of 2 — Cacti CVEs from a corpus of 156, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-16661 | Medium | 4.9 | 2017-11-08 | Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?fi… |
CVE-2017-16660 | High | 7.2 | 2017-11-08 | Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a… |
CVE-2017-16641 | High | 7.2 | 2017-11-07 | lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save reques… |
CVE-2017-15194 | Medium | 6.1 | 2017-10-11 | include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page. |
CVE-2017-12978 | Medium | 5.4 | 2017-08-21 | lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user. |
CVE-2017-12927 | Medium | 6.1 | 2017-08-18 | A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php. |
CVE-2017-12066 | Medium | 5.4 | 2017-08-01 | Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti before 1.1.16 allows remote authenticated users to inject arbitrary web script or HTM… |
CVE-2017-12065 | Critical | 9.8 | 2017-08-01 | spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter. |
CVE-2017-11691 | Medium | 5.4 | 2017-07-27 | Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially craft… |
CVE-2017-1000032 | Medium | 6.1 | 2017-07-17 | Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.ph… |
CVE-2017-1000031 | High | 8.8 | 2017-07-17 | SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b allows remote attackers to execute arbitrary SQL commands via the graph_template_inpu… |
CVE-2017-11163 | Medium | 5.4 | 2017-07-10 | Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via s… |
CVE-2017-10970 | Medium | 5.4 | 2017-07-06 | Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter… |
CVE-2016-2313 | High | 8.8 | 2016-04-13 | auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a us… |
CVE-2016-3172 | High | 8.8 | 2016-04-12 | SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parent_id param… |
CVE-2015-8604 | High | 8.8 | 2016-04-11 | SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrar… |
CVE-2016-3659 | High | 8.8 | 2016-04-11 | SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data para… |
CVE-2015-8369 | | 2015-12-17 | SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_i… | |
CVE-2015-8377 | | 2015-12-15 | SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arb… | |
CVE-2015-4634 | | 2015-08-11 | SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter. | |
CVE-2015-2967 | | 2015-07-10 | Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified… | |
CVE-2015-4454 | | 2015-06-17 | SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQ… | |
CVE-2015-4342 | | 2015-06-17 | SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id. | |
CVE-2015-2665 | | 2015-06-17 | Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | |
CVE-2015-0916 | | 2015-05-22 | SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id para… | |
CVE-2014-5026 | | 2014-10-20 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML… | |
CVE-2014-5025 | | 2014-10-20 | Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web scri… | |
CVE-2014-5262 | | 2014-08-22 | SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL comm… | |
CVE-2014-5261 | | 2014-08-22 | The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a… | |
CVE-2014-4002 | | 2014-07-03 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parame… | |
CVE-2014-4644 | | 2014-06-25 | SQL injection vulnerability in superlinks.php in the superlinks plugin 1.4-2 for Cacti allows remote attackers to execute arbitrary SQL commands via the id par… | |
CVE-2014-2709 | | 2014-04-23 | lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters. | |
CVE-2014-2328 | | 2014-04-23 | lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecifi… | |
CVE-2014-2327 | | 2014-04-23 | Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecif… | |
CVE-2014-2708 | | 2014-04-10 | Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the… | |
CVE-2014-2326 | | 2014-03-27 | Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via u… | |
CVE-2013-5589 | | 2013-08-29 | SQL injection vulnerability in cacti/host.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2013-5588 | | 2013-08-29 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the step… | |
CVE-2013-1435 | | 2013-08-23 | (1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors. | |
CVE-2013-1434 | | 2013-08-23 | Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL command… | |
CVE-2011-5223 | | 2012-10-25 | Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victim… | |
CVE-2011-4824 | | 2011-12-15 | SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter. | |
CVE-2010-2545 | | 2010-08-23 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, al… | |
CVE-2010-2544 | | 2010-08-23 | Cross-site scripting (XSS) vulnerability in utilities.php in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other produc… | |
CVE-2010-2543 | | 2010-08-23 | Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML… | |
CVE-2010-1645 | | 2010-08-23 | Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arb… | |
CVE-2010-1644 | | 2010-08-23 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, al… | |
CVE-2010-2092 | | 2010-05-27 | SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter i… | |
CVE-2010-1431 | | 2010-05-04 | SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_i… | |
CVE-2009-4112 | | 2009-11-30 | Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage"… | |
CVE-2009-4032 | | 2009-11-29 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gr… | |
CVE-2008-0786 | | 2008-02-14 | CRLF injection vulnerability in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k, when running on older PHP interpreters, allows remote attackers to inject ar… | |
CVE-2008-0785 | | 2008-02-14 | Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands… | |
CVE-2008-0784 | | 2008-02-14 | graph.php in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allows remote attackers to obtain the full path via an invalid local_graph_id parameter and othe… | |
CVE-2008-0783 | | 2008-02-14 | Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote attackers to inject arbitrary web script… | |
CVE-2007-6035 | | 2007-11-20 | SQL injection vulnerability in graph.php in Cacti before 0.8.7a allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter. |