CVE-2002-1478

CVE-2002-1478 affects Cacti prior to 0.6.8. The issue allows an attacker to execute arbitrary commands via the Data Input option in console mode, due to the underlying handling of input. The vulnerability is documented with a high impact (CVSS v2 base score 10.0; confidentiality, integrity, and a...

CVE-2002-1479

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php with world-readable permissions. This allows local users to modify databases as the Cacti user and potentially gain privileges. Affected product: Cacti (versions prior to 0.6.8). Root cause: credentials stored in p...

CVE-2002-1477

CVE-2002-1477 affects Cacti polished prior to 0.6.8. The issue is in graphs.php where an attacker with authenticated Cacti admin privileges can inject shell metacharacters into the title during edit mode to execute arbitrary commands. This is a remote-authenticated access risk with potential comm...

CVE-2002-1478

Cacti before 0.6.8 allows attackers to execute arbitrary commands via the "Data Input" option in console mode...

CVE-2002-1479

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges...

CVE-2002-1478

Cacti before 0.6.8 allows attackers to execute arbitrary commands via the "Data Input" option in console mode...

CVE-2002-1477

graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode...

CVE-2002-1478: Undefined Security Weakness

Cacti before 0.6.8 allows attackers to execute arbitrary commands via the "Data Input" option in console mode...

CVE-2002-1477: Undefined Security Weakness

graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary commands via shell metacharacters in the title during edit mode...

CVE-2002-1479: Undefined Security Weakness

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges...

GLSA-200408-21 : Cacti: SQL injection vulnerability

The remote host is affected by the vulnerability described in GLSA-200408-21 Cacti: SQL injection vulnerability Cacti is vulnerable to a SQL injection attack where an attacker may inject SQL into the Username field. Impact : An attacker could compromise the Cacti service and potentially execute...

Cacti: SQL injection vulnerability

Background Cacti is a complete web-based front end to rrdtool. Description Cacti is vulnerable to a SQL injection attack where an attacker may inject SQL into the Username field. Impact An attacker could compromise the Cacti service and potentially execute programs with the permissions of the use...

SQL Injection in CACTI

///////////////////////////////////////////////////// //// Vulnerable Program: CACTI //// //// Version : The latest version 0.8.5a //// //// Url: http://www.raxnet.net //// //// The Bug: SQL injection to allows bypass the auth. //// //// Date: Today, August 16 off 2004 //// //// Author: Fernando...

CVE-2004-1737

SQL injection vulnerability in authlogin.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username or 2 password parameters...

DEBIAN-CVE-2004-1737

SQL injection vulnerability in authlogin.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username or 2 password parameters...

CVE-2004-1737

SQL injection vulnerability in authlogin.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username or 2 password parameters...

cacti -- SQL injection

Fernando Quintero reports that Cacti 0.8.5a suffers from a SQL injection attack where an attacker can change the password for any Cacti user. This attack is not possible if the PHP option magicquotesgpc is set to On, which is the default for PHP in FreeBSD...

RaXnet Cacti 0.6.x/0.8.x - 'Auth_Login.php' SQL Injection

source: https://www.securityfocus.com/bid/10960/info RaXnet Cacti is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the authlogin.php script due to a failure of the application to properly sanitize user-supplied "username" URI parameter input before using it in ...

RaXnet Cacti 0.6.x0.8.x - Auth_Login.php SQL Injection

RaXnet Cacti 0.6.x0.8.x - AuthLogin.php SQL Injection source: https://www.securityfocus.com/bid/10960/info RaXnet Cacti is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the authlogin.php script due to a failure of the application to properly sanitize...

CVE-2002-1479

Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable permissions, which allows local users to modify databases as the Cacti user and possibly gain privileges...