rpm package
opensuse/cacti-spine&distro=openSUSE Leap 15.4
pkg:rpm/opensuse/cacti-spine&distro=openSUSE%20Leap%2015.4
Vulnerabilities (18)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-39511 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 6, 2023 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin | ||
| CVE-2023-30534 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making t | ||
| CVE-2023-39362 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution | ||
| CVE-2023-39364 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` a | ||
| CVE-2023-39516 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin | ||
| CVE-2023-39365 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. | ||
| CVE-2023-39357 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save function do not perf | ||
| CVE-2023-39358 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.ph | ||
| CVE-2023-39359 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` fil | ||
| CVE-2023-39361 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an ena | ||
| CVE-2023-39360 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Several validations are pe | ||
| CVE-2023-39366 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrat | ||
| CVE-2023-39510 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrat | ||
| CVE-2023-39512 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin | ||
| CVE-2023-39513 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin | ||
| CVE-2023-39515 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrativ | ||
| CVE-2023-39514 | — | < 1.2.25-bp155.2.3.1 | 1.2.25-bp155.2.3.1 | Sep 5, 2023 | Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin | ||
| CVE-2022-46169 | — | KEV | < 1.2.23-bp154.2.6.1 | 1.2.23-bp154.2.6.1 | Dec 5, 2022 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a |
- CVE-2023-39511Sep 6, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin
- CVE-2023-30534Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making t
- CVE-2023-39362Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution
- CVE-2023-39364Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, users with console access can be redirected to an arbitrary website after a change password performed via a specifically crafted URL. The `auth_changepassword.php` file accepts `ref` a
- CVE-2023-39516Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin
- CVE-2023-39365Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25.
- CVE-2023-39357Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the column type is numeric, the sql_save function directly utilizes user input. Many files and functions calling the sql_save function do not perf
- CVE-2023-39358Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `reports_user.ph
- CVE-2023-39359Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the `graphs.php` fil
- CVE-2023-39361Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are being utilized in an ena
- CVE-2023-39360Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data. The vulnerability is found in `graphs_new.php`. Several validations are pe
- CVE-2023-39366Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrat
- CVE-2023-39510Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by administrat
- CVE-2023-39512Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin
- CVE-2023-39513Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin
- CVE-2023-39515Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrativ
- CVE-2023-39514Sep 5, 2023affected < 1.2.25-bp155.2.3.1fixed 1.2.25-bp155.2.3.1
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting (XSS) Vulnerability which allows an authenticated user to poison data stored in the _cacti_'s database. These data will be viewed by admin
- affected < 1.2.23-bp154.2.6.1fixed 1.2.23-bp154.2.6.1
Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a