DATABASE RESOURCES PRICING ABOUT US

{"id": "OPENVAS:70703", "vendorId": null, "type": "openvas", "bulletinFamily": "scanner", "title": "Debian Security Advisory DSA 2384-1 (cacti)", "description": "The remote host is missing an update to cacti\nannounced via advisory DSA 2384-1.", "published": "2012-02-11T00:00:00", "modified": "2017-07-07T00:00:00", "epss": [{"cve": "CVE-2011-4824", "epss": 0.00365, "percentile": 0.69347, "modified": "2023-11-20"}, {"cve": "CVE-2010-2545", "epss": 0.00141, "percentile": 0.49687, "modified": "2023-11-20"}, {"cve": "CVE-2010-2543", "epss": 0.00275, "percentile": 0.64639, "modified": "2023-11-20"}, {"cve": "CVE-2010-1645", "epss": 0.00506, "percentile": 0.73804, "modified": "2023-11-20"}, {"cve": "CVE-2010-1644", "epss": 0.00316, "percentile": 0.67097, "modified": "2023-11-20"}], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "cvss2": {}, "cvss3": {}, "href": "http://plugins.openvas.org/nasl.php?oid=70703", "reporter": "Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com", "references": [], "cvelist": ["CVE-2011-4824", "CVE-2010-2545", "CVE-2010-2543", "CVE-2010-1645", "CVE-2010-1644"], "immutableFields": [], "lastseen": "2017-07-24T12:51:18", "viewCount": 9, "enchantments": {"score": {"value": 0.2, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2010-1644", "CVE-2010-1645", "CVE-2010-2543", "CVE-2010-2545", "CVE-2011-4824"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2384-1:5D2A4", "DEBIAN:DSA-2384-2:E6E08"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2010-1644", "DEBIANCVE:CVE-2010-1645", "DEBIANCVE:CVE-2010-2543", "DEBIANCVE:CVE-2010-2545", "DEBIANCVE:CVE-2011-4824"]}, {"type": "gentoo", "idList": ["GLSA-201401-20"]}, {"type": "nessus", "idList": ["CACTI_087E.NASL", "CACTI_087G.NASL", "DEBIAN_DSA-1954.NASL", "DEBIAN_DSA-2384.NASL", "FEDORA_2011-15032.NASL", "FEDORA_2011-15071.NASL", "FEDORA_2011-15110.NASL", "GENTOO_GLSA-201401-20.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:100655", "OPENVAS:100764", "OPENVAS:103319", "OPENVAS:1361412562310100655", "OPENVAS:1361412562310100764", "OPENVAS:1361412562310103319", "OPENVAS:1361412562310121117", "OPENVAS:136141256231070612", "OPENVAS:136141256231070703", "OPENVAS:136141256231070722", "OPENVAS:1361412562310831138", "OPENVAS:1361412562310831531", "OPENVAS:70722", "OPENVAS:831138", "OPENVAS:831531"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:27547", "SECURITYVULNS:VULN:12133"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2010-1644", "UB:CVE-2010-1645", "UB:CVE-2010-2543", "UB:CVE-2010-2545", "UB:CVE-2011-4824"]}, {"type": "veracode", "idList": ["VERACODE:24130", "VERACODE:24131", "VERACODE:24134"]}]}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2010-1644", "CVE-2010-1645", "CVE-2010-2543", "CVE-2010-2545"]}, {"type": "debian", "idList": ["DEBIAN:DSA-2384-2:E6E08"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2010-1644", "DEBIANCVE:CVE-2010-1645", "DEBIANCVE:CVE-2010-2543", "DEBIANCVE:CVE-2010-2545"]}, {"type": "gentoo", "idList": ["GLSA-201401-20"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/GENTOO-LINUX-CVE-2010-1644/", "MSF:ILITIES/GENTOO-LINUX-CVE-2010-2545/"]}, {"type": "nessus", "idList": ["FEDORA_2011-15032.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:136141256231070703"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:12133"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2010-1644", "UB:CVE-2010-1645", "UB:CVE-2010-2543", "UB:CVE-2010-2545"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2011-4824", "epss": "0.003650000", "percentile": "0.680610000", "modified": "2023-03-15"}, {"cve": "CVE-2010-2545", "epss": "0.001410000", "percentile": "0.480930000", "modified": "2023-03-15"}, {"cve": "CVE-2010-2543", "epss": "0.002750000", "percentile": "0.631020000", "modified": "2023-03-15"}, {"cve": "CVE-2010-1645", "epss": "0.005060000", "percentile": "0.728600000", "modified": "2023-03-15"}, {"cve": "CVE-2010-1644", "epss": "0.003160000", "percentile": "0.656390000", "modified": "2023-03-15"}], "vulnersScore": 0.2}, "_state": {"dependencies": 1700514161, "score": 1700514790, "epss": 0}, "_internal": {"score_hash": "f0b851c10e823a8918c64bd5a79f092a"}, "pluginID": "70703", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2384_1.nasl 6612 2017-07-07 12:08:03Z cfischer $\n# Description: Auto-generated from advisory DSA 2384-1 (cacti)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Several vulnerabilities have been discovered in cacti, a graphing tool\nfor monitoring data. Multiple cross site scripting issues allow remote\nattackers to inject arbitrary web script or HTML. An SQL injection\nvulnerability allows remote attackers to execute arbitrary SQL commands.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.8.7b-2.1+lenny4.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 0.8.7g-1+squeeze1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.8.7i-2.\n\nWe recommend that you upgrade your cacti packages.\";\ntag_summary = \"The remote host is missing an update to cacti\nannounced via advisory DSA 2384-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202384-1\";\n\nif(description)\n{\n script_id(70703);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\", \"CVE-2010-2543\", \"CVE-2010-2545\", \"CVE-2011-4824\");\n script_version(\"$Revision: 6612 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:08:03 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-11 03:26:57 -0500 (Sat, 11 Feb 2012)\");\n script_name(\"Debian Security Advisory DSA 2384-1 (cacti)\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"cacti\", ver:\"0.8.7b-2.1+lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"cacti\", ver:\"0.8.7g-1+squeeze1\", rls:\"DEB6.0\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "naslFamily": "Debian Local Security Checks"}

{"openvas": [{"lastseen": "2017-07-24T12:50:44", "description": "The remote host is missing an update to cacti\nannounced via advisory DSA 2384-2.", "cvss3": {}, "published": "2012-02-12T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2384-2 (cacti)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824", "CVE-2010-2545", "CVE-2010-2543", "CVE-2010-1645", "CVE-2010-1644"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:70722", "href": "http://plugins.openvas.org/nasl.php?oid=70722", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2384_2.nasl 6612 2017-07-07 12:08:03Z cfischer $\n# Description: Auto-generated from advisory DSA 2384-2 (cacti)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"It was discovered that the last security update for cacti, DSA-2384-1,\nintroduced a regression in lenny.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.8.7b-2.1+lenny5.\n\nThe stable distribution (squeeze) is not affected by this regression.\n\nWe recommend that you upgrade your cacti packages.\";\ntag_summary = \"The remote host is missing an update to cacti\nannounced via advisory DSA 2384-2.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202384-2\";\n\nif(description)\n{\n script_id(70722);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\", \"CVE-2010-2543\", \"CVE-2010-2545\", \"CVE-2011-4824\");\n script_version(\"$Revision: 6612 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:08:03 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-12 06:39:49 -0500 (Sun, 12 Feb 2012)\");\n script_name(\"Debian Security Advisory DSA 2384-2 (cacti)\");\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"cacti\", ver:\"0.8.7b-2.1+lenny5\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:38:50", "description": "The remote host is missing an update to cacti\nannounced via advisory DSA 2384-1.", "cvss3": {}, "published": "2012-02-11T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2384-1 (cacti)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824", "CVE-2010-2545", "CVE-2010-2543", "CVE-2010-1645", "CVE-2010-1644"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:136141256231070703", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231070703", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2384_1.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Description: Auto-generated from advisory DSA 2384-1 (cacti)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.70703\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\", \"CVE-2010-2543\", \"CVE-2010-2545\", \"CVE-2011-4824\");\n script_version(\"$Revision: 14275 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-11 03:26:57 -0500 (Sat, 11 Feb 2012)\");\n script_name(\"Debian Security Advisory DSA 2384-1 (cacti)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB(5|6)\");\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202384-1\");\n script_tag(name:\"insight\", value:\"Several vulnerabilities have been discovered in cacti, a graphing tool\nfor monitoring data. Multiple cross site scripting issues allow remote\nattackers to inject arbitrary web script or HTML. An SQL injection\nvulnerability allows remote attackers to execute arbitrary SQL commands.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.8.7b-2.1+lenny4.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 0.8.7g-1+squeeze1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.8.7i-2.\");\n\n script_tag(name:\"solution\", value:\"We recommend that you upgrade your cacti packages.\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update to cacti\nannounced via advisory DSA 2384-1.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"cacti\", ver:\"0.8.7b-2.1+lenny4\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"cacti\", ver:\"0.8.7g-1+squeeze1\", rls:\"DEB6\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:38:54", "description": "The remote host is missing an update to cacti\nannounced via advisory DSA 2384-2.", "cvss3": {}, "published": "2012-02-12T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2384-2 (cacti)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824", "CVE-2010-2545", "CVE-2010-2543", "CVE-2010-1645", "CVE-2010-1644"], "modified": "2019-03-18T00:00:00", "id": "OPENVAS:136141256231070722", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231070722", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2384_2.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Description: Auto-generated from advisory DSA 2384-2 (cacti)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.70722\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\", \"CVE-2010-2543\", \"CVE-2010-2545\", \"CVE-2011-4824\");\n script_version(\"$Revision: 14275 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-02-12 06:39:49 -0500 (Sun, 12 Feb 2012)\");\n script_name(\"Debian Security Advisory DSA 2384-2 (cacti)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB5\");\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202384-2\");\n script_tag(name:\"insight\", value:\"It was discovered that the last security update for cacti, DSA-2384-1,\nintroduced a regression in lenny.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.8.7b-2.1+lenny5.\n\nThe stable distribution (squeeze) is not affected by this regression.\");\n\n script_tag(name:\"solution\", value:\"We recommend that you upgrade your cacti packages.\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update to cacti\nannounced via advisory DSA 2384-2.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"cacti\", ver:\"0.8.7b-2.1+lenny5\", rls:\"DEB5\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-12-14T11:48:51", "description": "Check for the Version of cacti", "cvss3": {}, "published": "2010-08-30T00:00:00", "type": "openvas", "title": "Mandriva Update for cacti MDVSA-2010:160 (cacti)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2544", "CVE-2010-2545", "CVE-2009-4032", "CVE-2010-2543", "CVE-2010-1645", "CVE-2010-1644"], "modified": "2017-12-13T00:00:00", "id": "OPENVAS:831138", "href": "http://plugins.openvas.org/nasl.php?oid=831138", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for cacti MDVSA-2010:160 (cacti)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities has been found and corrected in cacti:\n\n Multiple cross-site scripting (XSS) vulnerabilities in Cacti before\n 0.8.7f, allow remote attackers to inject arbitrary web script or\n HTML via the (1) hostname or (2) description parameter to host.php,\n or (3) the host_id parameter to data_sources.php (CVE-2010-1644).\n\n Cacti before 0.8.7f, allows remote authenticated administrators to\n execute arbitrary commands via shell metacharacters in (1) the FQDN\n field of a Device or (2) the Vertical Label field of a Graph Template\n (CVE-2010-1645).\n\n Cross-site scripting (XSS) vulnerability in\n include/top_graph_header.php in Cacti before 0.8.7g allows remote\n attackers to inject arbitrary web script or HTML via the graph_start\n parameter to graph.php. NOTE: this vulnerability exists because of\n an incorrect fix for CVE-2009-4032.2.b (CVE-2010-2543).\n\n Cross-site scripting (XSS) vulnerability in utilities.php in Cacti\n before 0.8.7g, allows remote attackers to inject arbitrary web script\n or HTML via the filter parameter (CVE-2010-2544).\n\n Multiple cross-site scripting (XSS) vulnerabilities in Cacti before\n 0.8.7g, allow remote attackers to inject arbitrary web script or HTML\n via (1) the name element in an XML template to templates_import.php;\n and allow remote authenticated administrators to inject arbitrary web\n script or HTML via vectors related to (2) cdef.php, (3) data_input.php,\n (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7)\n gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php,\n (11) graph_templates_inputs.php, (12) graph_templates_items.php,\n (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16)\n host_templates.php, (17) lib/functions.php, (18) lib/html_form.php,\n (19) lib/html_form_template.php, (20) lib/html.php, (21)\n lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php,\n and (25) user_admin.php (CVE-2010-2545).\n\n This update provides cacti 0.8.7f, which is not vulnerable to these\n issues.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"cacti on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-08/msg00021.php\");\n script_id(831138);\n script_version(\"$Revision: 8092 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-13 07:31:16 +0100 (Wed, 13 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-30 16:59:25 +0200 (Mon, 30 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_xref(name: \"MDVSA\", value: \"2010:160\");\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\", \"CVE-2009-4032\", \"CVE-2010-2543\", \"CVE-2010-2544\", \"CVE-2010-2545\");\n script_name(\"Mandriva Update for cacti MDVSA-2010:160 (cacti)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of cacti\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"cacti\", rpm:\"cacti~0.8.7g~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-01-02T10:54:40", "description": "Check for the Version of cacti", "cvss3": {}, "published": "2010-08-30T00:00:00", "type": "openvas", "title": "Mandriva Update for cacti MDVSA-2010:160 (cacti)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2544", "CVE-2010-2545", "CVE-2009-4032", "CVE-2010-2543", "CVE-2010-1645", "CVE-2010-1644"], "modified": "2017-12-25T00:00:00", "id": "OPENVAS:1361412562310831138", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310831138", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for cacti MDVSA-2010:160 (cacti)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities has been found and corrected in cacti:\n\n Multiple cross-site scripting (XSS) vulnerabilities in Cacti before\n 0.8.7f, allow remote attackers to inject arbitrary web script or\n HTML via the (1) hostname or (2) description parameter to host.php,\n or (3) the host_id parameter to data_sources.php (CVE-2010-1644).\n\n Cacti before 0.8.7f, allows remote authenticated administrators to\n execute arbitrary commands via shell metacharacters in (1) the FQDN\n field of a Device or (2) the Vertical Label field of a Graph Template\n (CVE-2010-1645).\n\n Cross-site scripting (XSS) vulnerability in\n include/top_graph_header.php in Cacti before 0.8.7g allows remote\n attackers to inject arbitrary web script or HTML via the graph_start\n parameter to graph.php. NOTE: this vulnerability exists because of\n an incorrect fix for CVE-2009-4032.2.b (CVE-2010-2543).\n\n Cross-site scripting (XSS) vulnerability in utilities.php in Cacti\n before 0.8.7g, allows remote attackers to inject arbitrary web script\n or HTML via the filter parameter (CVE-2010-2544).\n\n Multiple cross-site scripting (XSS) vulnerabilities in Cacti before\n 0.8.7g, allow remote attackers to inject arbitrary web script or HTML\n via (1) the name element in an XML template to templates_import.php;\n and allow remote authenticated administrators to inject arbitrary web\n script or HTML via vectors related to (2) cdef.php, (3) data_input.php,\n (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7)\n gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php,\n (11) graph_templates_inputs.php, (12) graph_templates_items.php,\n (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16)\n host_templates.php, (17) lib/functions.php, (18) lib/html_form.php,\n (19) lib/html_form_template.php, (20) lib/html.php, (21)\n lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php,\n and (25) user_admin.php (CVE-2010-2545).\n\n This update provides cacti 0.8.7f, which is not vulnerable to these\n issues.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"cacti on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2010-08/msg00021.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.831138\");\n script_version(\"$Revision: 8244 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-25 08:29:28 +0100 (Mon, 25 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-30 16:59:25 +0200 (Mon, 30 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_xref(name: \"MDVSA\", value: \"2010:160\");\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\", \"CVE-2009-4032\", \"CVE-2010-2543\", \"CVE-2010-2544\", \"CVE-2010-2545\");\n script_name(\"Mandriva Update for cacti MDVSA-2010:160 (cacti)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of cacti\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2010 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"cacti\", rpm:\"cacti~0.8.7g~0.1mdvmes5.1\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-09-01T11:05:48", "description": "Cacti is prone to multiple cross-site scripting vulnerabilities\nbecause the software fails to sufficiently sanitize user-\nsupplied input\n\nAn attacker may leverage these issues to execute arbitrary script code\nin the browser of an unsuspecting user in the context of the affected\nsite. This may allow the attacker to steal cookie-based authentication\ncredentials and to launch other attacks.\n\nVersions prior to Cacti 0.8.7f are vulnerable.", "cvss3": {}, "published": "2010-05-25T00:00:00", "type": "openvas", "title": "Cacti Multiple Cross Site Scripting Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1645", "CVE-2010-1644"], "modified": "2017-08-17T00:00:00", "id": "OPENVAS:100655", "href": "http://plugins.openvas.org/nasl.php?oid=100655", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_cacti_40332.nasl 6948 2017-08-17 07:13:38Z asteins $\n#\n# Cacti Multiple Cross Site Scripting Vulnerabilities\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_summary = \"Cacti is prone to multiple cross-site scripting vulnerabilities\nbecause the software fails to sufficiently sanitize user-\nsupplied input\n\nAn attacker may leverage these issues to execute arbitrary script code\nin the browser of an unsuspecting user in the context of the affected\nsite. This may allow the attacker to steal cookie-based authentication\ncredentials and to launch other attacks.\n\nVersions prior to Cacti 0.8.7f are vulnerable.\";\n\ntag_solution = \"Updates are available. Please see the references for details.\";\n\nif (description)\n{\n script_id(100655);\n script_version(\"$Revision: 6948 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-08-17 09:13:38 +0200 (Thu, 17 Aug 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-05-25 18:01:00 +0200 (Tue, 25 May 2010)\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\");\n script_bugtraq_id(40332);\n\n script_name(\"Cacti Multiple Cross Site Scripting Vulnerabilities\");\n\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/bid/40332\");\n script_xref(name : \"URL\" , value : \"http://cacti.net/\");\n script_xref(name : \"URL\" , value : \"http://www.cacti.net/release_notes_0_8_7f.php\");\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/archive/1/511393\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2010 Greenbone Networks GmbH\");\n script_dependencies(\"cacti_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"version_func.inc\");\n\nport = get_http_port(default:80);\nif(!get_port_state(port))exit(0);\n\nif (!can_host_php(port:port)) exit(0);\n\nif(vers = get_version_from_kb(port:port,app:\"cacti\")) {\n\n if(version_is_less(version: vers, test_version: \"0.8.7f\")) {\n security_message(port:port);\n exit(0);\n }\n\n}\n\nexit(0);\n", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:40:14", "description": "Cacti is prone to multiple cross-site scripting vulnerabilities because the\nsoftware fails to sufficiently sanitize user-supplied input.\n\nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in\nthe context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and\nto launch other attacks.\n\nVersions prior to Cacti 0.8.7f are vulnerable.", "cvss3": {}, "published": "2010-05-25T00:00:00", "type": "openvas", "title": "Cacti Multiple Cross Site Scripting Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1645", "CVE-2010-1644"], "modified": "2019-03-01T00:00:00", "id": "OPENVAS:1361412562310100655", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310100655", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_cacti_40332.nasl 13960 2019-03-01 13:18:27Z cfischer $\n#\n# Cacti Multiple Cross Site Scripting Vulnerabilities\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:cacti:cacti\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.100655\");\n script_version(\"$Revision: 13960 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-01 14:18:27 +0100 (Fri, 01 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2010-05-25 18:01:00 +0200 (Tue, 25 May 2010)\");\n script_tag(name:\"cvss_base\", value:\"6.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\");\n script_bugtraq_id(40332);\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_name(\"Cacti Multiple Cross Site Scripting Vulnerabilities\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/40332\");\n script_xref(name:\"URL\", value:\"http://cacti.net/\");\n script_xref(name:\"URL\", value:\"http://www.cacti.net/release_notes_0_8_7f.php\");\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/archive/1/511393\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2010 Greenbone Networks GmbH\");\n script_dependencies(\"cacti_detect.nasl\");\n script_mandatory_keys(\"cacti/installed\");\n\n script_tag(name:\"solution\", value:\"Updates are available. Please see the references for details.\");\n\n script_tag(name:\"summary\", value:\"Cacti is prone to multiple cross-site scripting vulnerabilities because the\nsoftware fails to sufficiently sanitize user-supplied input.\n\nAn attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in\nthe context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and\nto launch other attacks.\n\nVersions prior to Cacti 0.8.7f are vulnerable.\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!vers = get_app_version(cpe: CPE, port: port))\n exit(0);\n\nif (version_is_less(version: vers, test_version: \"0.8.7f\")) {\n report = report_fixed_ver(installed_version: vers, fixed_version: \"0.8.7f\");\n security_message(port: port, data: report);\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:36:12", "description": "Gentoo Linux Local Security Checks GLSA 201401-20", "cvss3": {}, "published": "2015-09-29T00:00:00", "type": "openvas", "title": "Gentoo Security Advisory GLSA 201401-20", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2544", "CVE-2013-1435", "CVE-2010-2545", "CVE-2010-2543", "CVE-2010-2092", "CVE-2013-1434", "CVE-2010-1645", "CVE-2010-1644"], "modified": "2018-10-26T00:00:00", "id": "OPENVAS:1361412562310121117", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121117", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: glsa-201401-20.nasl 12128 2018-10-26 13:35:25Z cfischer $\n#\n# Gentoo Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.121117\");\n script_version(\"$Revision: 12128 $\");\n script_tag(name:\"creation_date\", value:\"2015-09-29 11:26:37 +0300 (Tue, 29 Sep 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-26 15:35:25 +0200 (Fri, 26 Oct 2018) $\");\n script_name(\"Gentoo Security Advisory GLSA 201401-20\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://security.gentoo.org/glsa/201401-20\");\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\", \"CVE-2010-2092\", \"CVE-2010-2543\", \"CVE-2010-2544\", \"CVE-2010-2545\", \"CVE-2013-1434\", \"CVE-2013-1435\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Gentoo Linux Local Security Checks GLSA 201401-20\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Gentoo Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\n\nif((res=ispkgvuln(pkg:\"net-analyzer/cacti\", unaffected: make_list(\"ge 0.8.8b\"), vulnerable: make_list(\"lt 0.8.8b\"))) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-08-31T16:16:35", "description": "Cacti is prone to cross-site-scripting and HTML-injection\nvulnerabilities because it fails to properly sanitize user-supplied\ninput before using it in dynamically generated content.\n\nAttacker-supplied HTML and script code would run in the context of the\naffected browser, potentially allowing the attacker to steal cookie-\nbased authentication credentials or to control how the site is\nrendered to the user. Other attacks are also possible.\n\nVersions prior to Cacti 0.8.7g are vulnerable.", "cvss3": {}, "published": "2010-08-30T00:00:00", "type": "openvas", "title": "Cacti Cross Site Scripting and HTML Injection Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2544", "CVE-2010-2545", "CVE-2010-2543"], "modified": "2017-08-16T00:00:00", "id": "OPENVAS:100764", "href": "http://plugins.openvas.org/nasl.php?oid=100764", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_cacti_42575.nasl 6941 2017-08-16 12:17:27Z cfischer $\n#\n# Cacti Cross Site Scripting and HTML Injection Vulnerabilities\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_summary = \"Cacti is prone to cross-site-scripting and HTML-injection\nvulnerabilities because it fails to properly sanitize user-supplied\ninput before using it in dynamically generated content.\n\nAttacker-supplied HTML and script code would run in the context of the\naffected browser, potentially allowing the attacker to steal cookie-\nbased authentication credentials or to control how the site is\nrendered to the user. Other attacks are also possible.\n\nVersions prior to Cacti 0.8.7g are vulnerable.\";\n\ntag_solution = \"Updates are available. Please see the references for more information.\";\n\nif (description)\n{\n script_id(100764);\n script_version(\"$Revision: 6941 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-08-16 14:17:27 +0200 (Wed, 16 Aug 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-30 14:30:07 +0200 (Mon, 30 Aug 2010)\");\n script_bugtraq_id(42575);\n script_cve_id(\"CVE-2010-2543\", \"CVE-2010-2544\",\"CVE-2010-2545\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_name(\"Cacti Cross Site Scripting and HTML Injection Vulnerabilities\");\n\n script_xref(name : \"URL\" , value : \"https://www.securityfocus.com/bid/42575\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=459105\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=459229\");\n script_xref(name : \"URL\" , value : \"http://cacti.net/\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2010 Greenbone Networks GmbH\");\n script_dependencies(\"cacti_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"version_func.inc\");\n\nport = get_http_port(default:80);\nif(!get_port_state(port))exit(0);\n\nif (!can_host_php(port:port)) exit(0);\n\nif(vers = get_version_from_kb(port:port,app:\"cacti\")) {\n\n if(version_is_less(version: vers, test_version: \"0.8.7g\")) {\n security_message(port:port);\n exit(0);\n }\n\n}\n\nexit(0);\n\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-05-29T18:40:06", "description": "Cacti is prone to cross-site-scripting and HTML-injection vulnerabilities\nbecause it fails to properly sanitize user-supplied input before using it in dynamically generated content.\n\nAttacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the\nattacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.\nOther attacks are also possible.\n\nVersions prior to Cacti 0.8.7g are vulnerable.", "cvss3": {}, "published": "2010-08-30T00:00:00", "type": "openvas", "title": "Cacti Cross Site Scripting and HTML Injection Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2544", "CVE-2010-2545", "CVE-2010-2543"], "modified": "2019-03-01T00:00:00", "id": "OPENVAS:1361412562310100764", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310100764", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_cacti_42575.nasl 13960 2019-03-01 13:18:27Z cfischer $\n#\n# Cacti Cross Site Scripting and HTML Injection Vulnerabilities\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2010 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:cacti:cacti\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.100764\");\n script_version(\"$Revision: 13960 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-01 14:18:27 +0100 (Fri, 01 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-30 14:30:07 +0200 (Mon, 30 Aug 2010)\");\n script_bugtraq_id(42575);\n script_cve_id(\"CVE-2010-2543\", \"CVE-2010-2544\", \"CVE-2010-2545\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_name(\"Cacti Cross Site Scripting and HTML Injection Vulnerabilities\");\n\n script_xref(name:\"URL\", value:\"https://www.securityfocus.com/bid/42575\");\n script_xref(name:\"URL\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=459105\");\n script_xref(name:\"URL\", value:\"https://bugzilla.redhat.com/show_bug.cgi?id=459229\");\n script_xref(name:\"URL\", value:\"http://cacti.net/\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2010 Greenbone Networks GmbH\");\n script_dependencies(\"cacti_detect.nasl\");\n script_mandatory_keys(\"cacti/installed\");\n\n script_tag(name:\"solution\", value:\"Updates are available. Please see the references for more information.\");\n\n script_tag(name:\"summary\", value:\"Cacti is prone to cross-site-scripting and HTML-injection vulnerabilities\nbecause it fails to properly sanitize user-supplied input before using it in dynamically generated content.\n\nAttacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the\nattacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.\nOther attacks are also possible.\n\nVersions prior to Cacti 0.8.7g are vulnerable.\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!vers = get_app_version(cpe: CPE, port: port))\n exit(0);\n\nif (version_is_less(version: vers, test_version: \"0.8.7g\")) {\n report = report_fixed_ver(installed_version: vers, fixed_version: \"0.8.7g\");\n security_message(port: port, data: report);\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2019-05-29T18:39:04", "description": "The remote host is missing an update to the system\n as announced in the referenced advisory.", "cvss3": {}, "published": "2012-02-13T00:00:00", "type": "openvas", "title": "FreeBSD Ports: cacti", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824"], "modified": "2018-10-05T00:00:00", "id": "OPENVAS:136141256231070612", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231070612", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: freebsd_cacti9.nasl 11762 2018-10-05 10:54:12Z cfischer $\n#\n# Auto generated from VID f08e2c15-ffc9-11e0-b0f3-bcaec565249c\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.70612\");\n script_cve_id(\"CVE-2011-4824\");\n script_tag(name:\"creation_date\", value:\"2012-02-13 01:48:16 +0100 (Mon, 13 Feb 2012)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-05 12:54:12 +0200 (Fri, 05 Oct 2018) $\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_version(\"$Revision: 11762 $\");\n script_name(\"FreeBSD Ports: cacti\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsd\", \"ssh/login/freebsdrel\");\n\n script_tag(name:\"insight\", value:\"The following package is affected: cacti\");\n\n script_tag(name:\"solution\", value:\"Update your system with the appropriate patches or\n software upgrades.\");\n\n script_xref(name:\"URL\", value:\"http://www.cacti.net/release_notes_0_8_7h.php\");\n script_xref(name:\"URL\", value:\"http://www.vuxml.org/freebsd/f08e2c15-ffc9-11e0-b0f3-bcaec565249c.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update to the system\n as announced in the referenced advisory.\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-bsd.inc\");\n\nvuln = FALSE;\ntxt = \"\";\n\nbver = portver(pkg:\"cacti\");\nif(!isnull(bver) && revcomp(a:bver, b:\"0.8.7h\")<0) {\n txt += 'Package cacti version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\n\nif(vuln) {\n security_message(data:txt);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:38:41", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2012-01-23T00:00:00", "type": "openvas", "title": "Mandriva Update for cacti MDVSA-2012:010 (cacti)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824"], "modified": "2018-11-16T00:00:00", "id": "OPENVAS:1361412562310831531", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310831531", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for cacti MDVSA-2012:010 (cacti)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.mandriva.com/security-announce/2012-01/msg00014.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.831531\");\n script_version(\"$Revision: 12381 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-16 12:16:30 +0100 (Fri, 16 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-01-23 11:31:36 +0530 (Mon, 23 Jan 2012)\");\n script_cve_id(\"CVE-2011-4824\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_xref(name:\"MDVSA\", value:\"2012:010\");\n script_name(\"Mandriva Update for cacti MDVSA-2012:010 (cacti)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'cacti'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\", re:\"ssh/login/release=MNDK_mes5\");\n script_tag(name:\"affected\", value:\"cacti on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"Multiple vulnerabilities has been found and corrected in cacti:\n\n SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h\n allows remote attackers to execute arbitrary SQL commands via the\n login_username parameter (CVE-2011-4824).\n\n Various vulnerabilities were discovered and fixed in the 0.8.7i version\n (cacti bug 2062).\n\n The updated packages provides the latest 0.8.7i version which are\n not affected by these issues.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"cacti\", rpm:\"cacti~0.8.7i~0.1mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2018-01-08T12:58:45", "description": "Check for the Version of cacti", "cvss3": {}, "published": "2012-01-23T00:00:00", "type": "openvas", "title": "Mandriva Update for cacti MDVSA-2012:010 (cacti)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824"], "modified": "2018-01-08T00:00:00", "id": "OPENVAS:831531", "href": "http://plugins.openvas.org/nasl.php?oid=831531", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for cacti MDVSA-2012:010 (cacti)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple vulnerabilities has been found and corrected in cacti:\n\n SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h\n allows remote attackers to execute arbitrary SQL commands via the\n login_username parameter (CVE-2011-4824).\n\n Various vulnerabilities were discovered and fixed in the 0.8.7i version\n (cacti bug 2062).\n\n The updated packages provides the latest 0.8.7i version which are\n not affected by these issues.\";\n\ntag_affected = \"cacti on Mandriva Enterprise Server 5,\n Mandriva Enterprise Server 5/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2012-01/msg00014.php\");\n script_id(831531);\n script_version(\"$Revision: 8313 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-08 08:02:11 +0100 (Mon, 08 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2012-01-23 11:31:36 +0530 (Mon, 23 Jan 2012)\");\n script_cve_id(\"CVE-2011-4824\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_xref(name: \"MDVSA\", value: \"2012:010\");\n script_name(\"Mandriva Update for cacti MDVSA-2012:010 (cacti)\");\n\n script_tag(name: \"summary\" , value: \"Check for the Version of cacti\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_mes5\")\n{\n\n if ((res = isrpmvuln(pkg:\"cacti\", rpm:\"cacti~0.8.7i~0.1mdvmes5.2\", rls:\"MNDK_mes5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-09-04T14:19:58", "description": "Cacti is prone to an SQL-injection vulnerability and a cross-site\nscripting vulnerability because it fails to sufficiently sanitize user-\nsupplied data.\n\nExploiting these issues could allow an attacker to steal cookie-\nbased authentication credentials, compromise the application,\naccess or modify data, or exploit latent vulnerabilities in the\nunderlying database.\n\nCacti 0.8.7g is vulnerable; other versions may also be affected.", "cvss3": {}, "published": "2011-11-15T00:00:00", "type": "openvas", "title": "Cacti Unspecified SQL Injection and Cross Site Scripting Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824", "CVE-2014-2326"], "modified": "2017-08-28T00:00:00", "id": "OPENVAS:103319", "href": "http://plugins.openvas.org/nasl.php?oid=103319", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_cacti_50671.nasl 7015 2017-08-28 11:51:24Z teissa $\n#\n# Cacti Unspecified SQL Injection and Cross Site Scripting Vulnerabilities\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_summary = \"Cacti is prone to an SQL-injection vulnerability and a cross-site\nscripting vulnerability because it fails to sufficiently sanitize user-\nsupplied data.\n\nExploiting these issues could allow an attacker to steal cookie-\nbased authentication credentials, compromise the application,\naccess or modify data, or exploit latent vulnerabilities in the\nunderlying database.\n\nCacti 0.8.7g is vulnerable; other versions may also be affected.\";\n\ntag_solution = \"The vendor has released fixes. Please see the references for details.\";\n\nif (description)\n{\n script_id(103319);\n script_bugtraq_id(50671);\n script_cve_id(\"CVE-2011-4824\", \"CVE-2014-2326\");\n script_version (\"$Revision: 7015 $\");\n\n script_name(\"Cacti Unspecified SQL Injection and Cross Site Scripting Vulnerabilities\");\n\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/bid/50671\");\n script_xref(name : \"URL\" , value : \"http://cacti.net/\");\n script_xref(name : \"URL\" , value : \"http://www.cacti.net/release_notes_0_8_7h.php\");\n\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-08-28 13:51:24 +0200 (Mon, 28 Aug 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-11-15 08:09:39 +0100 (Tue, 15 Nov 2011)\");\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2011 Greenbone Networks GmbH\");\n script_dependencies(\"cacti_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_exclude_keys(\"Settings/disable_cgi_scanning\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"http_keepalive.inc\");\ninclude(\"version_func.inc\");\n\nport = get_http_port(default:80);\nif(!get_port_state(port))exit(0);\n\nif (!can_host_php(port:port)) exit(0);\n\nif(vers = get_version_from_kb(port:port,app:\"cacti\")) {\n\n if(version_is_less(version: vers, test_version: \"0.8.7h\")) {\n security_message(port:port);\n exit(0);\n }\n\n}\n\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:39:56", "description": "Cacti is prone to an SQL-injection vulnerability and a cross-site scripting\nvulnerability because it fails to sufficiently sanitize user-supplied data.\n\nExploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the\napplication, access or modify data, or exploit latent vulnerabilities in the underlying database.\n\nCacti 0.8.7g is vulnerable. Other versions may also be affected.", "cvss3": {}, "published": "2011-11-15T00:00:00", "type": "openvas", "title": "Cacti Unspecified SQL Injection and Cross Site Scripting Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824", "CVE-2014-2326"], "modified": "2018-10-22T00:00:00", "id": "OPENVAS:1361412562310103319", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310103319", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_cacti_50671.nasl 12018 2018-10-22 13:31:29Z mmartin $\n#\n# Cacti Unspecified SQL Injection and Cross Site Scripting Vulnerabilities\n#\n# Authors:\n# Michael Meyer <michael.meyer@greenbone.net>\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:cacti:cacti\";\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.103319\");\n script_bugtraq_id(50671);\n script_cve_id(\"CVE-2011-4824\", \"CVE-2014-2326\");\n script_version(\"$Revision: 12018 $\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n script_name(\"Cacti Unspecified SQL Injection and Cross Site Scripting Vulnerabilities\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/50671\");\n script_xref(name:\"URL\", value:\"http://cacti.net/\");\n script_xref(name:\"URL\", value:\"http://www.cacti.net/release_notes_0_8_7h.php\");\n\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-22 15:31:29 +0200 (Mon, 22 Oct 2018) $\");\n script_tag(name:\"creation_date\", value:\"2011-11-15 08:09:39 +0100 (Tue, 15 Nov 2011)\");\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_copyright(\"This script is Copyright (C) 2011 Greenbone Networks GmbH\");\n script_dependencies(\"cacti_detect.nasl\");\n script_mandatory_keys(\"cacti/installed\");\n\n script_tag(name:\"solution\", value:\"The vendor has released fixes. Please see the references for details.\");\n\n script_tag(name:\"summary\", value:\"Cacti is prone to an SQL-injection vulnerability and a cross-site scripting\nvulnerability because it fails to sufficiently sanitize user-supplied data.\n\nExploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the\napplication, access or modify data, or exploit latent vulnerabilities in the underlying database.\n\nCacti 0.8.7g is vulnerable. Other versions may also be affected.\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif (!port = get_app_port(cpe: CPE))\n exit(0);\n\nif (!vers = get_app_version(cpe: CPE, port: port))\n exit(0);\n\nif (version_is_less(version: vers, test_version: \"0.8.7h\")) {\n report = report_fixed_ver(installed_version: vers, fixed_version: \"0.8.7h\");\n security_message(port: port, data: report);\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2023-12-08T12:29:49", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2384-1 security@debian.org\nhttp://www.debian.org/security/ Luk Claes\nJanuary 09, 2012 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : cacti\nVulnerability : several\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2010-1644 CVE-2010-1645 CVE-2010-2543 CVE-2010-2545 \n CVE-2011-4824 \n\nSeveral vulnerabilities have been discovered in cacti, a graphing tool\nfor monitoring data. Multiple cross site scripting issues allow remote\nattackers to inject arbitrary web script or HTML. An SQL injection\nvulnerability allows remote attackers to execute arbitrary SQL commands.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.8.7b-2.1+lenny4.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 0.8.7g-1+squeeze1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 0.8.7i-2.\n\nWe recommend that you upgrade your cacti packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2012-01-09T18:50:20", "type": "debian", "title": "[SECURITY] [DSA 2384-1] cacti security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1644", "CVE-2010-1645", "CVE-2010-2543", "CVE-2010-2545", "CVE-2011-4824"], "modified": "2012-01-09T18:50:20", "id": "DEBIAN:DSA-2384-1:5D2A4", "href": "https://lists.debian.org/debian-security-announce/2012/msg00007.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-08T12:22:16", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-2384-2 security@debian.org\nhttp://www.debian.org/security/ \nFebruary 04, 2012 http://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : cacti\nVulnerability : several\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2010-1644 CVE-2010-1645 CVE-2010-2543 CVE-2010-2545 \n CVE-2011-4824 \n\nIt was discovered that the last security update for cacti, DSA-2384-1,\nintroduced a regression in lenny.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.8.7b-2.1+lenny5.\n\nThe stable distribution (squeeze) is not affected by this regression.\n\nWe recommend that you upgrade your cacti packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: http://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {}, "published": "2012-02-04T17:18:52", "type": "debian", "title": "[SECURITY] [DSA 2384-2] cacti regression", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1644", "CVE-2010-1645", "CVE-2010-2543", "CVE-2010-2545", "CVE-2011-4824"], "modified": "2012-02-04T17:18:52", "id": "DEBIAN:DSA-2384-2:E6E08", "href": "https://lists.debian.org/debian-security-announce/2012/msg00029.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:43", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- -------------------------------------------------------------------------\r\nDebian Security Advisory DSA-2384-1 security@debian.org\r\nhttp://www.debian.org/security/ Luk Claes\r\nJanuary 09, 2012 http://www.debian.org/security/faq\r\n- -------------------------------------------------------------------------\r\n\r\nPackage : cacti\r\nVulnerability : several\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE ID : CVE-2010-1644 CVE-2010-1645 CVE-2010-2543 CVE-2010-2545 \r\n CVE-2011-4824 \r\n\r\nSeveral vulnerabilities have been discovered in cacti, a graphing tool\r\nfor monitoring data. Multiple cross site scripting issues allow remote\r\nattackers to inject arbitrary web script or HTML. An SQL injection\r\nvulnerability allows remote attackers to execute arbitrary SQL commands.\r\n\r\nFor the oldstable distribution &#40;lenny&#41;, this problem has been fixed in\r\nversion 0.8.7b-2.1+lenny4.\r\n\r\nFor the stable distribution &#40;squeeze&#41;, this problem has been fixed in\r\nversion 0.8.7g-1+squeeze1.\r\n\r\nFor the unstable distribution &#40;sid&#41;, this problem has been fixed in\r\nversion 0.8.7i-2.\r\n\r\nWe recommend that you upgrade your cacti packages.\r\n\r\nFurther information about Debian Security Advisories, how to apply\r\nthese updates to your system and frequently asked questions can be\r\nfound at: http://www.debian.org/security/\r\n\r\nMailing list: debian-security-announce@lists.debian.org\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.9 &#40;GNU/Linux&#41;\r\n\r\niQEcBAEBAgAGBQJPCzo5AAoJEL97/wQC1SS+dHIH/3ucFAVBmeSUVc+i3z94aZ7C\r\njY0SsdkTEBl8Mk61z33K43NVcxScXK3dyXIF4ns1Zd/CV/KCZ61nQ2CtPiCiiK0G\r\nLg6oyR0ezwFxaBXl8fHPOtGQxaQO0l4VoyTphsWIVRKZzNz9u/RQq+kir/FXq6zF\r\n6R/nVejnf/xXywisjnUpOr+kpTfCDo4V2iPZb6MX1vdz2WPlOJUme4UEc7QQLuMW\r\n9y807Jh8UYTs+3ZxB3cI2whq5k74gh8Ba75VLZUHDabrxsMT/d87qTT26vsvk2UD\r\n8X3Lzozlbcqd3/fVolZwt7Lv+i9iSc/T9j6qBMALzQgsEdH15bHptrGVzibEhFo=\r\n=2HDx\r\n-----END PGP SIGNATURE-----\r\n", "cvss3": {}, "published": "2012-01-09T00:00:00", "type": "securityvulns", "title": "[SECURITY] [DSA 2384-1] cacti security update", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2011-4824", "CVE-2010-2545", "CVE-2010-2543", "CVE-2010-1645", "CVE-2010-1644"], "modified": "2012-01-09T00:00:00", "id": "SECURITYVULNS:DOC:27547", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:27547", "sourceData": "", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2021-06-08T18:49:52", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "cvss3": {}, "published": "2012-01-09T00:00:00", "type": "securityvulns", "title": "Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2011-4824", "CVE-2010-2545", "CVE-2011-3657", "CVE-2010-2543", "CVE-2011-5026", "CVE-2010-1645", "CVE-2010-1644", "CVE-2011-5019"], "modified": "2012-01-09T00:00:00", "id": "SECURITYVULNS:VULN:12133", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:12133", "sourceData": "", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2023-12-07T15:34:30", "description": "Several vulnerabilities have been discovered in Cacti, a graphing tool for monitoring data. Multiple cross site scripting issues allow remote attackers to inject arbitrary web script or HTML. A SQL injection vulnerability allows remote attackers to execute arbitrary SQL commands.", "cvss3": {}, "published": "2012-01-12T00:00:00", "type": "nessus", "title": "Debian DSA-2384-2 : cacti - several vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1644", "CVE-2010-1645", "CVE-2010-2543", "CVE-2010-2545", "CVE-2011-4824"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:cacti", "cpe:/o:debian:debian_linux:5.0", "cpe:/o:debian:debian_linux:6.0"], "id": "DEBIAN_DSA-2384.NASL", "href": "https://www.tenable.com/plugins/nessus/57524", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2384. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(57524);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\", \"CVE-2010-2543\", \"CVE-2010-2545\", \"CVE-2011-4824\");\n script_bugtraq_id(37109, 39639, 40332, 42575, 50671);\n script_xref(name:\"DSA\", value:\"2384\");\n\n script_name(english:\"Debian DSA-2384-2 : cacti - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been discovered in Cacti, a graphing tool\nfor monitoring data. Multiple cross site scripting issues allow remote\nattackers to inject arbitrary web script or HTML. A SQL injection\nvulnerability allows remote attackers to execute arbitrary SQL\ncommands.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/squeeze/cacti\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2012/dsa-2384\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the cacti packages.\n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 0.8.7b-2.1+lenny5.\n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 0.8.7g-1+squeeze1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:cacti\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:6.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/08/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/02/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/01/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"cacti\", reference:\"0.8.7b-2.1+lenny5\")) flag++;\nif (deb_check(release:\"6.0\", prefix:\"cacti\", reference:\"0.8.7g-1+squeeze1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-08T17:08:50", "description": "The remote host is affected by the vulnerability described in GLSA-201401-20 (Cacti: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details.\n Impact :\n\n A remote attacker could execute arbitrary SQL commands via specially crafted parameters, execute arbitrary shell code or inject malicious script code.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {}, "published": "2014-01-22T00:00:00", "type": "nessus", "title": "GLSA-201401-20 : Cacti: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1644", "CVE-2010-1645", "CVE-2010-2092", "CVE-2010-2543", "CVE-2010-2544", "CVE-2010-2545", "CVE-2013-1434", "CVE-2013-1435"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:cacti", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-201401-20.NASL", "href": "https://www.tenable.com/plugins/nessus/72075", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201401-20.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(72075);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2010-1644\", \"CVE-2010-1645\", \"CVE-2010-2092\", \"CVE-2010-2543\", \"CVE-2010-2544\", \"CVE-2010-2545\", \"CVE-2013-1434\", \"CVE-2013-1435\");\n script_bugtraq_id(37109, 39639, 40149, 40332, 42575, 61657, 61847);\n script_xref(name:\"GLSA\", value:\"201401-20\");\n\n script_name(english:\"GLSA-201401-20 : Cacti: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201401-20\n(Cacti: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in Cacti. Please review\n the CVE identifiers referenced below for details.\n \nImpact :\n\n A remote attacker could execute arbitrary SQL commands via specially\n crafted parameters, execute arbitrary shell code or inject malicious\n script code.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201401-20\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Cacti users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-analyzer/cacti-0.8.8b'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:cacti\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/01/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/01/22\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-analyzer/cacti\", unaffected:make_list(\"ge 0.8.8b\"), vulnerable:make_list(\"lt 0.8.8b\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Cacti\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-08T15:06:16", "description": "Update to latest upstream release. Fixes SQL injection and XSS.\nUpstream re= lease notes are at http://www.cacti.net/release_notes_0_8_7h.php\n----------------------------------------------------------------------\n-----=\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2011-11-14T00:00:00", "type": "nessus", "title": "Fedora 14 : cacti-0.8.7h-1.fc14 (2011-15110)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:cacti", "cpe:/o:fedoraproject:fedora:14"], "id": "FEDORA_2011-15110.NASL", "href": "https://www.tenable.com/plugins/nessus/56795", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-15110.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(56795);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2011-4824\");\n script_xref(name:\"FEDORA\", value:\"2011-15110\");\n\n script_name(english:\"Fedora 14 : cacti-0.8.7h-1.fc14 (2011-15110)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to latest upstream release. Fixes SQL injection and XSS.\nUpstream re= lease notes are at\nhttp://www.cacti.net/release_notes_0_8_7h.php\n----------------------------------------------------------------------\n-----=\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # http://www.cacti.net/release_notes_0_8_7h.php\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.cacti.net/release_notes_0_8_7h.php\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=748451\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2011-November/069137.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?30c39f51\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected cacti package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:cacti\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:14\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/10/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/11/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^14([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 14.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC14\", reference:\"cacti-0.8.7h-1.fc14\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"cacti\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-08T15:06:25", "description": "Update to latest upstream release. Fixes SQL injection and XSS.\nUpstream re= lease notes are at http://www.cacti.net/release_notes_0_8_7h.php\n----------------------------------------------------------------------\n-----=\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2011-11-14T00:00:00", "type": "nessus", "title": "Fedora 16 : cacti-0.8.7h-1.fc16 (2011-15032)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:cacti", "cpe:/o:fedoraproject:fedora:16"], "id": "FEDORA_2011-15032.NASL", "href": "https://www.tenable.com/plugins/nessus/56793", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-15032.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(56793);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2011-4824\");\n script_xref(name:\"FEDORA\", value:\"2011-15032\");\n\n script_name(english:\"Fedora 16 : cacti-0.8.7h-1.fc16 (2011-15032)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to latest upstream release. Fixes SQL injection and XSS.\nUpstream re= lease notes are at\nhttp://www.cacti.net/release_notes_0_8_7h.php\n----------------------------------------------------------------------\n-----=\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # http://www.cacti.net/release_notes_0_8_7h.php\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.cacti.net/release_notes_0_8_7h.php\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=748451\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2011-November/069126.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?805d0ba8\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected cacti package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:cacti\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:16\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/10/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/11/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^16([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 16.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC16\", reference:\"cacti-0.8.7h-1.fc16\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"cacti\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-08T15:05:57", "description": "Update to latest upstream release. Fixes SQL injection and XSS.\nUpstream re= lease notes are at http://www.cacti.net/release_notes_0_8_7h.php\n----------------------------------------------------------------------\n-----=\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2011-11-14T00:00:00", "type": "nessus", "title": "Fedora 15 : cacti-0.8.7h-1.fc15 (2011-15071)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4824"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:cacti", "cpe:/o:fedoraproject:fedora:15"], "id": "FEDORA_2011-15071.NASL", "href": "https://www.tenable.com/plugins/nessus/56794", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2011-15071.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(56794);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2011-4824\");\n script_xref(name:\"FEDORA\", value:\"2011-15071\");\n\n script_name(english:\"Fedora 15 : cacti-0.8.7h-1.fc15 (2011-15071)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Update to latest upstream release. Fixes SQL injection and XSS.\nUpstream re= lease notes are at\nhttp://www.cacti.net/release_notes_0_8_7h.php\n----------------------------------------------------------------------\n-----=\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # http://www.cacti.net/release_notes_0_8_7h.php\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.cacti.net/release_notes_0_8_7h.php\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=748451\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2011-November/069141.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?6828d051\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected cacti package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:cacti\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:15\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/10/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/11/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^15([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 15.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC15\", reference:\"cacti-0.8.7h-1.fc15\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"cacti\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-08T15:21:53", "description": "According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.7g. It is, therefore, potentially affected by multiple cross-site scripting and HTML injection vulnerabilities. An attacker may be able to exploit these issues to inject arbitrary HTML or script code into a user's browser to be executed within the security context of the affected site.", "cvss3": {}, "published": "2012-01-20T00:00:00", "type": "nessus", "title": "Cacti < 0.8.7g Multiple XSS and HTML Injection Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-2544", "CVE-2010-2545"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:cacti:cacti"], "id": "CACTI_087G.NASL", "href": "https://www.tenable.com/plugins/nessus/57617", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(57617);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\"CVE-2010-2544\", \"CVE-2010-2545\");\n script_bugtraq_id(42575);\n\n script_name(english:\"Cacti < 0.8.7g Multiple XSS and HTML Injection Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server is running a PHP application that is affected by\nmultiple cross-site scripting and HTML injection vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version number, the Cacti application\nrunning on the remote web server is prior to version 0.8.7g. It is,\ntherefore, potentially affected by multiple cross-site scripting and\nHTML injection vulnerabilities. An attacker may be able to exploit\nthese issues to inject arbitrary HTML or script code into a user's\nbrowser to be executed within the security context of the affected\nsite.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://cacti.net/release_notes_0_8_7g.php\");\n script_set_attribute(attribute:\"see_also\", value:\"https://marc.info/?l=oss-security&m=127978954522586\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Cacti 0.8.7g or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No exploit is required\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/07/10\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/07/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/01/20\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:cacti:cacti\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses : XSS\");\n\n script_copyright(english:\"This script is Copyright (C) 2012-2022 Tenable Network Security, Inc.\");\n\n script_dependencies(\"cacti_detect.nasl\");\n script_require_keys(\"www/PHP\", \"installed_sw/cacti\", \"Settings/ParanoidReport\");\n script_require_ports(\"Services/www\", 80);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"install_func.inc\");\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\napp = 'cacti';\nget_install_count(app_name:'cacti', exit_if_zero:TRUE);\n\nport = get_http_port(default:80, php:TRUE);\n\ninstall = get_single_install(app_name:app, port:port, exit_if_unknown_ver:TRUE);\ncacti_base = build_url(qs:install['path'], port:port);\nversion = install['version'];\n\n# Versions < 0.8.7g are affected.\nver = split(version, sep:'.', keep:FALSE);\nif (\n (int(ver[0]) == 0) &&\n (\n (int(ver[1]) < 8) ||\n (int(ver[1]) == 8 && ver[2] =~ '^([0-6][a-z]?|7[a-f]?)$')\n )\n)\n{\n set_kb_item(name:'www/'+port+'/XSS', value:TRUE);\n if (report_verbosity > 0)\n {\n report = '\\n URL : ' + cacti_base +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 0.8.7g' +\n '\\n';\n security_warning(port:port, extra:report);\n }\n else security_warning(port);\n exit(0);\n}\naudit(AUDIT_WEB_APP_NOT_AFFECTED, \"Cacti\", cacti_base, version);\n\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-07T16:35:47", "description": "According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.7f. It is, therefore, potentially affected by the following vulnerabilities :\n\n - A vulnerability exists in 'templates_export.php' due to improper validation of input to the 'export_item_id' parameter. A remote attacker can exploit this to inject SQL queries to disclose arbitrary data. (CVE-2010-1431)\n\n - Cross-site scripting vulnerabilities exist related to the 'host_id' parameter of 'data_sources.php', or the 'hostname' and 'description' parameters of 'host.php', which a remote attacker can exploit to inject arbitrary web script or HTML. (CVE-2010-1644)\n\n - A SQL injection vulnerability in 'graph.php' exists which can be exploited by a remote attacker using specially crafted GET requests to the 'rra_id' parameter which can cause a corresponding POST request or cookie to bypass proper validation. (CVE-2010-2092)", "cvss3": {}, "published": "2010-05-04T00:00:00", "type": "nessus", "title": "Cacti < 0.8.7f Multiple Input Validation Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2010-1431", "CVE-2010-1644", "CVE-2010-2092"], "modified": "2022-04-11T00:00:00", "cpe": ["cpe:/a:cacti:cacti"], "id": "CACTI_087E.NASL", "href": "https://www.tenable.com/plugins/nessus/46222", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(46222);\n script_version(\"1.20\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/04/11\");\n\n script_cve_id(\"CVE-2010-1431\", \"CVE-2010-1644\", \"CVE-2010-2092\");\n script_bugtraq_id(39653, 40149, 40332);\n script_xref(name:\"SECUNIA\", value:\"39570\");\n\n script_name(english:\"Cacti < 0.8.7f Multiple Input Validation Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote web server is running a PHP application that is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version number, the Cacti application\nrunning on the remote web server is prior to version 0.8.7f. It is,\ntherefore, potentially affected by the following vulnerabilities :\n\n - A vulnerability exists in 'templates_export.php' due to\n improper validation of input to the 'export_item_id'\n parameter. A remote attacker can exploit this to inject\n SQL queries to disclose arbitrary data. (CVE-2010-1431)\n\n - Cross-site scripting vulnerabilities exist related to\n the 'host_id' parameter of 'data_sources.php', or the\n 'hostname' and 'description' parameters of 'host.php',\n which a remote attacker can exploit to inject arbitrary\n web script or HTML. (CVE-2010-1644)\n\n - A SQL injection vulnerability in 'graph.php' exists\n which can be exploited by a remote attacker using\n specially crafted GET requests to the 'rra_id' parameter\n which can cause a corresponding POST request or cookie\n to bypass proper validation. (CVE-2010-2092)\");\n # http://www.bonsai-sec.com/en/research/vulnerabilities/cacti-os-command-injection-0105.php\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?39e1a6fb\");\n # http://www.php-security.org/2010/05/13/mops-2010-023-cacti-graph-viewer-sql-injection-vulnerability/index.html\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?49d1a123\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.securityfocus.com/archive/1/511393/30/0/threaded\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www.cacti.net/release_notes_0_8_7f.php\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Cacti 0.8.7f or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2010/04/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/04/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/05/04\");\n\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:cacti:cacti\");\n script_set_attribute(attribute:\"thorough_tests\", value:\"true\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"CGI abuses\");\n\n script_copyright(english:\"This script is Copyright (C) 2010-2022 Tenable Network Security, Inc.\");\n\n script_dependencies(\"cacti_detect.nasl\");\n script_require_keys(\"installed_sw/cacti\", \"Settings/ParanoidReport\");\n script_require_ports(\"Services/www\", 80);\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"install_func.inc\");\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\napp = 'cacti';\nget_install_count(app_name:app, exit_if_zero:TRUE);\n\nport = get_http_port(default:80, php:TRUE);\ninstall = get_single_install(app_name:app, port:port, exit_if_unknown_ver:TRUE);\ninstall_url = build_url(qs:install['path'], port:port);\n\n# Versions < 0.8.7f are affected.\nver = split(install['version'], sep:'.', keep:FALSE);\nif (\n (int(ver[0]) == 0) &&\n (\n (int(ver[1]) < 8) ||\n (int(ver[1]) == 8 && ver[2] =~ '^([0-6][a-z]?|7[a-e]?)$')\n )\n)\n{\n set_kb_item(name:'www/'+port+'/SQLInjection', value:TRUE);\n set_kb_item(name:'www/'+port+'/XSS', value:TRUE);\n if (report_verbosity > 0)\n {\n report = '\\n URL : ' + install_url +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 0.8.7e' +\n '\\n';\n security_hole(port:port, extra:report);\n }\n else security_hole(port);\n exit(0);\n}\naudit(AUDIT_WEB_APP_NOT_AFFECTED, \"Cacti\", install_url, install['version']);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-12-08T16:19:51", "description": "Several vulnerabilities have been found in cacti, a frontend to rrdtool for monitoring systems and services. The Common Vulnerabilities and Exposures project identifies the following problems :\n\n - CVE-2007-3112, CVE-2007-3113 It was discovered that cacti is prone to a denial of service via the graph_height, graph_width, graph_start and graph_end parameters. This issue only affects the oldstable (etch) version of cacti.\n\n - CVE-2009-4032 It was discovered that cacti is prone to several cross-site scripting attacks via different vectors.\n\n - CVE-2009-4112 It has been discovered that cacti allows authenticated administrator users to gain access to the host system by executing arbitrary commands via the 'Data Input Method' for the 'Linux - Get Memory Usage' setting.\n\n There is no fix for this issue at this stage. Upstream will implement a whitelist policy to only allow certain 'safe' commands.\n For the moment, we recommend that such access is only given to trusted users and that the options 'Data Input' and 'User Administration' are otherwise deactivated.", "cvss3": {}, "published": "2010-02-24T00:00:00", "type": "nessus", "title": "Debian DSA-1954-1 : cacti - insufficient input sanitising", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-3112", "CVE-2007-3113", "CVE-2009-4032", "CVE-2009-4112", "CVE-2010-2543"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:cacti", "cpe:/o:debian:debian_linux:4.0", "cpe:/o:debian:debian_linux:5.0"], "id": "DEBIAN_DSA-1954.NASL", "href": "https://www.tenable.com/plugins/nessus/44819", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1954. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(44819);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2007-3112\", \"CVE-2007-3113\", \"CVE-2009-4032\", \"CVE-2010-2543\");\n script_bugtraq_id(37109);\n script_xref(name:\"DSA\", value:\"1954\");\n\n script_name(english:\"Debian DSA-1954-1 : cacti - insufficient input sanitising\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several vulnerabilities have been found in cacti, a frontend to\nrrdtool for monitoring systems and services. The Common\nVulnerabilities and Exposures project identifies the following\nproblems :\n\n - CVE-2007-3112, CVE-2007-3113\n It was discovered that cacti is prone to a denial of\n service via the graph_height, graph_width, graph_start\n and graph_end parameters. This issue only affects the\n oldstable (etch) version of cacti.\n\n - CVE-2009-4032\n It was discovered that cacti is prone to several\n cross-site scripting attacks via different vectors.\n\n - CVE-2009-4112\n It has been discovered that cacti allows authenticated\n administrator users to gain access to the host system by\n executing arbitrary commands via the 'Data Input Method'\n for the 'Linux - Get Memory Usage' setting.\n\n There is no fix for this issue at this stage. Upstream will\n implement a whitelist policy to only allow certain 'safe' commands.\n For the moment, we recommend that such access is only given to\n trusted users and that the options 'Data Input' and 'User\n Administration' are otherwise deactivated.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=429224\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2007-3112\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2007-3113\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-4032\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2009-4112\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2009/dsa-1954\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the cacti packages.\n\nFor the oldstable distribution (etch), these problems have been fixed\nin version 0.8.6i-3.6.\n\nFor the stable distribution (lenny), this problem has been fixed in\nversion 0.8.7b-2.1+lenny1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(79);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:cacti\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:4.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/12/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/02/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"4.0\", prefix:\"cacti\", reference:\"0.8.6i-3.6\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"cacti\", reference:\"0.8.7b-2.1+lenny1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "gentoo": [{"lastseen": "2023-12-08T20:53:12", "description": "### Background\n\nCacti is a complete network graphing solution designed to harness the power of RRDTool\u2019s data storage and graphing functionality. \n\n### Description\n\nMultiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker could execute arbitrary SQL commands via specially crafted parameters, execute arbitrary shell code or inject malicious script code. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Cacti users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-analyzer/cacti-0.8.8b\"", "cvss3": {}, "published": "2014-01-21T00:00:00", "type": "gentoo", "title": "Cacti: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1644", "CVE-2010-1645", "CVE-2010-2092", "CVE-2010-2543", "CVE-2010-2544", "CVE-2010-2545", "CVE-2013-1434", "CVE-2013-1435"], "modified": "2014-01-21T00:00:00", "id": "GLSA-201401-20", "href": "https://security.gentoo.org/glsa/201401-20", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "ubuntucve": [{"lastseen": "2023-12-06T16:48:48", "description": "SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows\nremote attackers to execute arbitrary SQL commands via the login_username\nparameter.\n\n#### Bugs\n\n * <https://bugs.launchpad.net/ubuntu/+source/cacti/+bug/906773>\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652371>\n", "cvss3": {}, "published": "2011-12-15T00:00:00", "type": "ubuntucve", "title": "CVE-2011-4824", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4824"], "modified": "2011-12-15T00:00:00", "id": "UB:CVE-2011-4824", "href": "https://ubuntu.com/security/CVE-2011-4824", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-06T17:06:01", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g,\nas used in Red Hat High Performance Computing (HPC) Solution and other\nproducts, allow remote attackers to inject arbitrary web script or HTML via\n(1) the name element in an XML template to templates_import.php; and allow\nremote authenticated administrators to inject arbitrary web script or HTML\nvia vectors related to (2) cdef.php, (3) data_input.php, (4)\ndata_queries.php, (5) data_sources.php, (6) data_templates.php, (7)\ngprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php,\n(11) graph_templates_inputs.php, (12) graph_templates_items.php, (13)\ngraph_templates.php, (14) graph_view.php, (15) host.php, (16)\nhost_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19)\nlib/html_form_template.php, (20) lib/html.php, (21) lib/html_tree.php, (22)\nlib/rrd.php, (23) rra.php, (24) tree.php, and (25) user_admin.php.", "cvss3": {}, "published": "2010-08-23T00:00:00", "type": "ubuntucve", "title": "CVE-2010-2545", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2545"], "modified": "2010-08-23T00:00:00", "id": "UB:CVE-2010-2545", "href": "https://ubuntu.com/security/CVE-2010-2545", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-06T17:06:01", "description": "Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC)\nSolution and other products, allows remote authenticated administrators to\nexecute arbitrary commands via shell metacharacters in (1) the FQDN field\nof a Device or (2) the Vertical Label field of a Graph Template.", "cvss3": {}, "published": "2010-08-23T00:00:00", "type": "ubuntucve", "title": "CVE-2010-1645", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1645"], "modified": "2010-08-23T00:00:00", "id": "UB:CVE-2010-1645", "href": "https://ubuntu.com/security/CVE-2010-1645", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-12-06T17:06:01", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f,\nas used in Red Hat High Performance Computing (HPC) Solution and other\nproducts, allow remote attackers to inject arbitrary web script or HTML via\nthe (1) hostname or (2) description parameter to host.php, or (3) the\nhost_id parameter to data_sources.php.", "cvss3": {}, "published": "2010-08-23T00:00:00", "type": "ubuntucve", "title": "CVE-2010-1644", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1644"], "modified": "2010-08-23T00:00:00", "id": "UB:CVE-2010-1644", "href": "https://ubuntu.com/security/CVE-2010-1644", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-06T17:06:00", "description": "Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in\nCacti before 0.8.7g allows remote attackers to inject arbitrary web script\nor HTML via the graph_start parameter to graph.php. NOTE: this\nvulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.", "cvss3": {}, "published": "2010-08-23T00:00:00", "type": "ubuntucve", "title": "CVE-2010-2543", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2009-4032", "CVE-2010-2543"], "modified": "2010-08-23T00:00:00", "id": "UB:CVE-2010-2543", "href": "https://ubuntu.com/security/CVE-2010-2543", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "prion": [{"lastseen": "2023-11-22T04:50:54", "description": "SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.", "cvss3": {}, "published": "2011-12-15T03:57:00", "type": "prion", "title": "Sql injection", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4824"], "modified": "2017-08-29T01:30:00", "id": "PRION:CVE-2011-4824", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2011-4824", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T04:55:10", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) hostname or (2) description parameter to host.php, or (3) the host_id parameter to data_sources.php.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "prion", "title": "Cross site scripting", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1644"], "modified": "2023-02-13T04:19:00", "id": "PRION:CVE-2010-1644", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2010-1644", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-11-22T04:55:10", "description": "Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "prion", "title": "Design/Logic Flaw", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1645"], "modified": "2012-02-16T04:03:00", "id": "PRION:CVE-2010-1645", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2010-1645", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T04:56:56", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_template.php, (20) lib/html.php, (21) lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php, and (25) user_admin.php.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "prion", "title": "Cross site scripting", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2545"], "modified": "2023-02-13T03:17:00", "id": "PRION:CVE-2010-2545", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2010-2545", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-11-22T04:56:55", "description": "Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "prion", "title": "Cross site scripting", "bulletinFamily": "NVD", "cvss2": {"baseSeverity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "source": "nvd@nist.gov", "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "type": "Primary", "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2009-4032", "CVE-2010-2543"], "modified": "2023-11-07T02:05:00", "id": "PRION:CVE-2010-2543", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2010-2543", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "debiancve": [{"lastseen": "2023-12-06T18:20:58", "description": "SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.", "cvss3": {}, "published": "2011-12-15T03:57:00", "type": "debiancve", "title": "CVE-2011-4824", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4824"], "modified": "2011-12-15T03:57:00", "id": "DEBIANCVE:CVE-2011-4824", "href": "https://security-tracker.debian.org/tracker/CVE-2011-4824", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-06T18:20:58", "description": "Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "debiancve", "title": "CVE-2010-1645", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1645"], "modified": "2010-08-23T22:00:00", "id": "DEBIANCVE:CVE-2010-1645", "href": "https://security-tracker.debian.org/tracker/CVE-2010-1645", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-12-06T18:20:58", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) hostname or (2) description parameter to host.php, or (3) the host_id parameter to data_sources.php.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "debiancve", "title": "CVE-2010-1644", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1644"], "modified": "2010-08-23T22:00:00", "id": "DEBIANCVE:CVE-2010-1644", "href": "https://security-tracker.debian.org/tracker/CVE-2010-1644", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-06T18:20:58", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_template.php, (20) lib/html.php, (21) lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php, and (25) user_admin.php.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "debiancve", "title": "CVE-2010-2545", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2545"], "modified": "2010-08-23T22:00:00", "id": "DEBIANCVE:CVE-2010-2545", "href": "https://security-tracker.debian.org/tracker/CVE-2010-2545", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-08T22:20:41", "description": "Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "debiancve", "title": "CVE-2010-2543", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2009-4032", "CVE-2010-2543"], "modified": "2010-08-23T22:00:00", "id": "DEBIANCVE:CVE-2010-2543", "href": "https://security-tracker.debian.org/tracker/CVE-2010-2543", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "cve": [{"lastseen": "2023-12-06T14:35:10", "description": "SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.", "cvss3": {}, "published": "2011-12-15T03:57:00", "type": "cve", "title": "CVE-2011-4824", "cwe": ["CWE-89"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4824"], "modified": "2017-08-29T01:30:00", "cpe": ["cpe:/a:cacti:cacti:0.8.5", "cpe:/a:cacti:cacti:0.8.6j", "cpe:/a:cacti:cacti:0.8", "cpe:/a:cacti:cacti:0.6.4", "cpe:/a:cacti:cacti:0.8.7d", "cpe:/a:cacti:cacti:0.8.7", "cpe:/a:cacti:cacti:0.8.6f", "cpe:/a:cacti:cacti:0.6.7", "cpe:/a:cacti:cacti:0.8.6", "cpe:/a:cacti:cacti:0.8.6b", "cpe:/a:cacti:cacti:0.8.7e", "cpe:/a:cacti:cacti:0.8.7g", "cpe:/a:cacti:cacti:0.8.6a", "cpe:/a:cacti:cacti:0.8.6d", "cpe:/a:cacti:cacti:0.6.3", "cpe:/a:cacti:cacti:0.8.2a", "cpe:/a:cacti:cacti:0.8.2", "cpe:/a:cacti:cacti:0.6.2", "cpe:/a:cacti:cacti:0.6.6", "cpe:/a:cacti:cacti:0.6.1", "cpe:/a:cacti:cacti:0.8.3", "cpe:/a:cacti:cacti:0.8.7b", "cpe:/a:cacti:cacti:0.8.5a", "cpe:/a:cacti:cacti:0.8.6c", "cpe:/a:cacti:cacti:0.6", "cpe:/a:cacti:cacti:0.8.6g", "cpe:/a:cacti:cacti:0.8.6i", "cpe:/a:cacti:cacti:0.8.7c", "cpe:/a:cacti:cacti:0.5", "cpe:/a:cacti:cacti:0.6.8", "cpe:/a:cacti:cacti:0.8.6k", "cpe:/a:cacti:cacti:0.8.3a", "cpe:/a:cacti:cacti:0.8.6h", "cpe:/a:cacti:cacti:0.8.7a", "cpe:/a:cacti:cacti:0.8.1", "cpe:/a:cacti:cacti:0.6.8a", "cpe:/a:cacti:cacti:0.6.5", "cpe:/a:cacti:cacti:0.8.4"], "id": "CVE-2011-4824", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4824", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:cacti:cacti:0.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6j:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6b:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7b:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6h:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6k:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6f:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6g:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7g:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.5:-:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7e:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6i:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-06T14:21:40", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_template.php, (20) lib/html.php, (21) lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php, and (25) user_admin.php.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "cve", "title": "CVE-2010-2545", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2545"], "modified": "2023-02-13T03:17:00", "cpe": ["cpe:/a:cacti:cacti:0.6.4", "cpe:/a:cacti:cacti:0.8.7a", "cpe:/a:cacti:cacti:0.8.6c", "cpe:/a:cacti:cacti:0.8.6a", "cpe:/a:cacti:cacti:0.6.8", "cpe:/a:cacti:cacti:0.8.7", "cpe:/a:cacti:cacti:0.8.7e", "cpe:/a:cacti:cacti:0.6.3", "cpe:/a:cacti:cacti:0.6.2", "cpe:/a:cacti:cacti:0.6.8a", "cpe:/a:cacti:cacti:0.8.6k", "cpe:/a:cacti:cacti:0.6.6", "cpe:/a:cacti:cacti:0.8.2a", "cpe:/a:cacti:cacti:0.8.6g", "cpe:/a:cacti:cacti:0.8.6j", "cpe:/a:cacti:cacti:0.8.7f", "cpe:/a:cacti:cacti:0.8.2", "cpe:/a:cacti:cacti:0.6.5", "cpe:/a:cacti:cacti:0.8.6f", "cpe:/a:cacti:cacti:0.8.3", "cpe:/a:cacti:cacti:0.8.7d", "cpe:/a:cacti:cacti:0.8.7c", "cpe:/a:cacti:cacti:0.8.5", "cpe:/a:cacti:cacti:0.8.6d", "cpe:/a:cacti:cacti:0.6", "cpe:/a:cacti:cacti:0.8.6b", "cpe:/a:cacti:cacti:0.6.7", "cpe:/a:cacti:cacti:0.8", "cpe:/a:cacti:cacti:0.5", "cpe:/a:cacti:cacti:0.8.4", "cpe:/a:cacti:cacti:0.8.3a", "cpe:/a:cacti:cacti:0.6.1", "cpe:/a:cacti:cacti:0.8.5a", "cpe:/a:cacti:cacti:0.8.6h", "cpe:/a:cacti:cacti:0.8.6i", "cpe:/a:cacti:cacti:0.8.7b", "cpe:/a:cacti:cacti:0.8.6", "cpe:/a:cacti:cacti:0.8.1"], "id": "CVE-2010-2545", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2545", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:cacti:cacti:0.8.7b:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6g:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7e:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.5:-:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6i:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6f:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6j:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6h:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6k:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7f:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6b:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-06T14:15:04", "description": "Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in (1) the FQDN field of a Device or (2) the Vertical Label field of a Graph Template.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "cve", "title": "CVE-2010-1645", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1645"], "modified": "2012-02-16T04:03:00", "cpe": ["cpe:/a:cacti:cacti:0.6.4", "cpe:/a:cacti:cacti:0.8.7a", "cpe:/a:cacti:cacti:0.8.6c", "cpe:/a:cacti:cacti:0.8.6a", "cpe:/a:cacti:cacti:0.6.8", "cpe:/a:cacti:cacti:0.8.7", "cpe:/a:cacti:cacti:0.8.7e", "cpe:/a:cacti:cacti:0.6.3", "cpe:/a:cacti:cacti:0.6.2", "cpe:/a:cacti:cacti:0.6.8a", "cpe:/a:cacti:cacti:0.8.6k", "cpe:/a:cacti:cacti:0.6.6", "cpe:/a:cacti:cacti:0.8.2a", "cpe:/a:cacti:cacti:0.8.6g", "cpe:/a:cacti:cacti:0.8.6j", "cpe:/a:cacti:cacti:0.8.2", "cpe:/a:cacti:cacti:0.6.5", "cpe:/a:cacti:cacti:0.8.6f", "cpe:/a:cacti:cacti:0.8.3", "cpe:/a:cacti:cacti:0.8.7d", "cpe:/a:cacti:cacti:0.8.7c", "cpe:/a:cacti:cacti:0.8.5", "cpe:/a:cacti:cacti:0.8.6d", "cpe:/a:cacti:cacti:0.6", "cpe:/a:cacti:cacti:0.8.6b", "cpe:/a:cacti:cacti:0.6.7", "cpe:/a:cacti:cacti:0.8", "cpe:/a:cacti:cacti:0.5", "cpe:/a:cacti:cacti:0.8.4", "cpe:/a:cacti:cacti:0.8.3a", "cpe:/a:cacti:cacti:0.6.1", "cpe:/a:cacti:cacti:0.8.5a", "cpe:/a:cacti:cacti:0.8.6h", "cpe:/a:cacti:cacti:0.8.6i", "cpe:/a:cacti:cacti:0.8.7b", "cpe:/a:cacti:cacti:0.8.6", "cpe:/a:cacti:cacti:0.8.1"], "id": "CVE-2010-1645", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1645", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:cacti:cacti:0.8.7b:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6g:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7e:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.5:-:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6i:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6f:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6j:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6h:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6k:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6b:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-06T14:15:05", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7f, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) hostname or (2) description parameter to host.php, or (3) the host_id parameter to data_sources.php.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "cve", "title": "CVE-2010-1644", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1644"], "modified": "2023-02-13T04:19:00", "cpe": ["cpe:/a:cacti:cacti:0.6.4", "cpe:/a:cacti:cacti:0.8.7a", "cpe:/a:cacti:cacti:0.8.6c", "cpe:/a:cacti:cacti:0.8.6a", "cpe:/a:cacti:cacti:0.6.8", "cpe:/a:cacti:cacti:0.8.7", "cpe:/a:cacti:cacti:0.8.7e", "cpe:/a:cacti:cacti:0.6.3", "cpe:/a:cacti:cacti:0.6.2", "cpe:/a:cacti:cacti:0.6.8a", "cpe:/a:cacti:cacti:0.8.6k", "cpe:/a:cacti:cacti:0.6.6", "cpe:/a:cacti:cacti:0.8.2a", "cpe:/a:cacti:cacti:0.8.6g", "cpe:/a:cacti:cacti:0.8.6j", "cpe:/a:cacti:cacti:0.8.2", "cpe:/a:cacti:cacti:0.6.5", "cpe:/a:cacti:cacti:0.8.6f", "cpe:/a:cacti:cacti:0.8.3", "cpe:/a:cacti:cacti:0.8.7d", "cpe:/a:cacti:cacti:0.8.7c", "cpe:/a:cacti:cacti:0.8.5", "cpe:/a:cacti:cacti:0.8.6d", "cpe:/a:cacti:cacti:0.6", "cpe:/a:cacti:cacti:0.8.6b", "cpe:/a:cacti:cacti:0.6.7", "cpe:/a:cacti:cacti:0.8", "cpe:/a:cacti:cacti:0.5", "cpe:/a:cacti:cacti:0.8.4", "cpe:/a:cacti:cacti:0.8.3a", "cpe:/a:cacti:cacti:0.6.1", "cpe:/a:cacti:cacti:0.8.5a", "cpe:/a:cacti:cacti:0.8.6h", "cpe:/a:cacti:cacti:0.8.6i", "cpe:/a:cacti:cacti:0.8.7b", "cpe:/a:cacti:cacti:0.8.6", "cpe:/a:cacti:cacti:0.8.1"], "id": "CVE-2010-1644", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1644", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:cacti:cacti:0.8.7b:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6g:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7e:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.5:-:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6i:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6f:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6j:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6h:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6k:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6b:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-07T14:21:44", "description": "Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.", "cvss3": {}, "published": "2010-08-23T22:00:00", "type": "cve", "title": "CVE-2010-2543", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2009-4032", "CVE-2010-2543"], "modified": "2023-11-07T02:05:00", "cpe": ["cpe:/a:cacti:cacti:0.8.6k", "cpe:/a:cacti:cacti:0.8.7e", "cpe:/a:cacti:cacti:0.8.7a", "cpe:/a:cacti:cacti:0.6.6", "cpe:/a:cacti:cacti:0.8.7d", "cpe:/a:cacti:cacti:0.8.6d", "cpe:/a:cacti:cacti:0.8.6c", "cpe:/a:cacti:cacti:0.8.5a", "cpe:/a:cacti:cacti:0.8.7b", "cpe:/a:cacti:cacti:0.6.1", "cpe:/a:cacti:cacti:0.6.5", "cpe:/a:cacti:cacti:0.6.3", "cpe:/a:cacti:cacti:0.5", "cpe:/a:cacti:cacti:0.8.7c", "cpe:/a:cacti:cacti:0.8.6", "cpe:/a:cacti:cacti:0.6", "cpe:/a:cacti:cacti:0.8.6a", "cpe:/a:cacti:cacti:0.8.4", "cpe:/a:cacti:cacti:0.6.4", "cpe:/a:cacti:cacti:0.6.8", "cpe:/a:cacti:cacti:0.8.7f", "cpe:/a:cacti:cacti:0.8.3", "cpe:/a:cacti:cacti:0.8.5", "cpe:/a:cacti:cacti:0.8", "cpe:/a:cacti:cacti:0.8.6g", "cpe:/a:cacti:cacti:0.8.2", "cpe:/a:cacti:cacti:0.8.6h", "cpe:/a:cacti:cacti:0.8.6i", "cpe:/a:cacti:cacti:0.8.3a", "cpe:/a:cacti:cacti:0.8.6f", "cpe:/a:cacti:cacti:0.6.8a", "cpe:/a:cacti:cacti:0.6.2", "cpe:/a:cacti:cacti:0.8.6j", "cpe:/a:cacti:cacti:0.8.2a", "cpe:/a:cacti:cacti:0.6.7", "cpe:/a:cacti:cacti:0.8.6b", "cpe:/a:cacti:cacti:0.8.7", "cpe:/a:cacti:cacti:0.8.1"], "id": "CVE-2010-2543", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-2543", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:cacti:cacti:0.8.6d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7b:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.5:-:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7c:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6f:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6k:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6h:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6g:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7f:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6j:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6b:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.6i:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.6.8a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7d:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.5a:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:cacti:cacti:0.8.7e:*:*:*:*:*:*:*"]}], "veracode": [{"lastseen": "2023-04-18T12:48:19", "description": "cacti is vulnerable to cross-site scripting (XSS). Multiple cross-site scripting (XSS) flaws were discovered in Cacti. An unauthenticated, or authenticated user with certain administrative privileges, could perform an XSS attack against victims viewing Cacti web pages.\n", "cvss3": {}, "published": "2020-04-10T00:47:00", "type": "veracode", "title": "Cross-Site Scripting (XSS)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-2545"], "modified": "2023-02-13T07:27:14", "id": "VERACODE:24134", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24134/summary", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2022-07-27T10:16:42", "description": "cacti is vulnerable to OS command injection. Multiple command injection flaws were discovered in Cacti. An authenticated user with certain administrative privileges could use these flaws to execute arbitrary commands on the Cacti server with the privileges of the web server user.\n", "cvss3": {}, "published": "2020-04-10T00:46:59", "type": "veracode", "title": "OS Command Injection", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1645"], "modified": "2022-04-19T18:24:51", "id": "VERACODE:24131", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24131/summary", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}}, {"lastseen": "2023-04-18T12:48:21", "description": "cacti is vulnerable to cross-site scripting (XSS). Multiple cross-site scripting (XSS) flaws were discovered in Cacti. An unauthenticated, or authenticated user with certain administrative privileges, could perform an XSS attack against victims viewing Cacti web pages.\n", "cvss3": {}, "published": "2020-04-10T00:46:58", "type": "veracode", "title": "Cross-Site Scripting (XSS)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2010-1644"], "modified": "2023-02-13T07:27:15", "id": "VERACODE:24130", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-24130/summary", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}]}