3446 matches found
CVE-2018-20724
CVE-2018-20724 is a cross-site scripting (XSS) vulnerability in Cacti before 1.2.0, caused by a lack of escaping unintended characters in the Website Hostname used by Data Collectors (pollers.php). Public documentation confirms fixes in later releases: cacti-spine updated to 1.2.9 (openSUSE/SUSE ...
CVE-2018-20724
A cross-site scripting XSS vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors...
CVE-2018-20725
A cross-site scripting XSS vulnerability exists in graphtemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label...
CVE-2018-20725
A cross-site scripting XSS vulnerability exists in graphtemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label...
CVE-2018-20726
CVE-2018-20726 affects Cacti (pre-1.2.0) with an XSS in host.php (via tree.php) due to missing escaping in the Website Hostname field for Devices. Exploitation details are not provided in the documents, but multiple advisories note this CVE alongside others and document remediation: upgrade to Ca...
CVE-2018-20723
CVE-2018-20723 is a cross-site scripting (XSS) vulnerability in Cacti’s color_templates.php where unintended characters in the Color Name field were not escaped, making it exploitable in versions prior to 1.2.0. Connected advisories show remediation through newer Cacti releases (e.g., openSUSE/SU...
CVE-2018-20726
A cross-site scripting XSS vulnerability exists in host.php via tree.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices...
CVE-2018-20724
A cross-site scripting XSS vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors...
CVE-2018-20725
CVE-2018-20725 affects Cacti before 1.2.0, where graph_templates.php Graph Vertical Label could be exploited due to insufficient escaping of characters. Connected OSV entries indicate that the fix was delivered in updates to cacti/cacti-spine (e.g., openSUSE/SUSE packages) and that CVE-2018-20725...
CVE-2018-20723
A cross-site scripting XSS vulnerability exists in colortemplates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color...
Security Bulletin: Open Source Cacti vulnerability affects IBM Platform RTM (CVE-2016-3172, CVE-2016-3659)
Summary Cacti is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements to the tree.php script using the parentid parameter, which could allow the attacker to view, add, modify or delete information in the back-end database. A remote attacker could send...
Cacti cross-site scripting vulnerability (CNVD-2018-08667)
Cacti is an open source, web-based network monitoring and mapping tool, a front-end application designed for the data logging tool RRDtool. Cacti suffers from a cross-site scripting vulnerability. The vulnerability arises because the getcurrentpage function in lib/functions.php relies on...
Cacti cross-site scripting vulnerability (CNVD-2018-08679)
Cacti is an open source, web-based network monitoring and mapping tool, a front-end application designed for the data logging tool RRDtool. A cross-site scripting vulnerability exists in the sanitizeuri function in versions of Cacti prior to 1.1.37, which can lead to cross-site scripting attacks...
CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...
CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...
CVE-2018-10060
Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...
CVE-2018-10061
Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENTQUOTES flag these calls occur when the htmlescape function in lib/html.php is not used...
CVE-2018-10059
Cacti before 1.1.37 has XSS because the getcurrentpage function in lib/functions.php relies on $SERVER'PHPSELF' instead of $SERVER'SCRIPTNAME' to determine a page name...