CVE-2017-1000032

CVE-2017-1000032 : XSS in Cacti 0.8.8b allows remote attackers to inject arbitrary web script or HTML via the parent_id parameter to tree.php and the drp_action parameter to data_sources.php. The connected notices (SU̲SE, NVD, CNVD, OSV, etc.) consistently describe the vulnerability in Cacti 0.8.8...

PT-2017-10742

Name of the Vulnerable Software and Affected Versions Cacti version 0.8.8b Description The issue concerns Cross-Site scripting XSS vulnerabilities. Remote attackers can inject arbitrary web script or HTML via the parent id parameter to "tree.php" and drp action parameter to "data sources.php"...

Cacti SQL Injection Vulnerability (CNVD-2016-02215)

Cacti is a suite of open source network traffic monitoring and analysis tools from the Cacti Group. A SQL injection vulnerability exists in the tree.php file in Cacti 0.8.8g and earlier versions, which can be exploited by remote attackers to execute arbitrary SQL commands with the help of the...

DEBIAN-CVE-2016-3172

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parentid parameter in an itemedit action...

ALPINE-CVE-2016-3172

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parentid parameter in an itemedit action...

CVE-2016-3172

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parentid parameter in an itemedit action...

CVE-2016-3172

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parentid parameter in an itemedit action...

CVE-2016-3172

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parentid parameter in an itemedit action...

CVE-2016-3172: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in tree.php in Cacti 0.8.8g and earlier allows remote authenticated users to execute arbitrary SQL commands via the parentid parameter in an itemedit action...

PT-2016-5401

Name of the Vulnerable Software and Affected Versions Cacti versions 0.8.8g and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the parent id parameter in an "item edit" action in the tree.php file. Recommendations For versio...

Cacti <= 0.8.7 tree.php Multiple Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/27749/info Cacti is prone to multiple unspecified input-validation vulnerabilities, including: - Multiple cross-site scripting vulnerabilities - Multiple SQL-injection vulnerabilities - An HTTP response-splitting...

CVE-2010-2545

Cacti before 0.8.7g contains multiple XSS vulnerabilities (including CVE-2010-2545) in various templates and admin paths. The GLSA notes remote script injection and the need to upgrade to the 0.8.8+ series as remediation; affected vectors include template name and numerous PHP/graph-related compo...

CVE-2008-0785

Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the 1 graphlist parameter to graphview.php, 2 leafid and id parameters to tree.php, 3 localgraphid parameter to graphxport.php, and 4...

CVE-2008-0785: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Cacti 0.8.7 before 0.8.7b and 0.8.6 before 0.8.6k allow remote authenticated users to execute arbitrary SQL commands via the 1 graphlist parameter to graphview.php, 2 leafid and id parameters to tree.php, 3 localgraphid parameter to graphxport.php, and 4...

CVE-2006-3346

SQL injection vulnerability in tree.php in MyNewsGroups 0.6 allows remote attackers to execute arbitrary SQL commands via the grpid parameter...

CVE-2006-3346

The CVE-2006-3346 entry concerns a SQL injection in tree.php on MyNewsGroups 0.6, exploitable via the grp_id parameter to remotely execute arbitrary SQL. The provided documents identify the affected product and the vulnerable parameter but do not specify the root cause details beyond generic SQL ...

CVE-2006-3346: Undefined Security Weakness

SQL injection vulnerability in tree.php in MyNewsGroups 0.6 allows remote attackers to execute arbitrary SQL commands via the grpid parameter...