Debian dla-4048 : cacti - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4048 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4048-1 [email protected]...

[SECURITY] [DSA 5862-1] cacti security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5862-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 10, 2025 https://www.debian.org/security/faq -...

Debian dsa-5862 : cacti - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5862 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5862-1 [email protected] https://www.debian.org/securit...

DSA-5862-1 cacti - security update

Bulletin has no description...

FreeBSD : cacti -- Multiple vulnerabilities (e7974ca5-e4c8-11ef-aab3-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e7974ca5-e4c8-11ef-aab3-40b034429ecf advisory. Cacti repo reports: Tenable has extracted the preceding description block directly from the...

CVE-2024-29895

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. In cmdrealtime.php line 119, the $pollerid used ...

The vulnerability of the graph creation function or graph template creation function of the Cacti network monitoring software allows a hacker to execute arbitrary code.

The vulnerability of the graph creation function or graph template creation function in the Cacti network monitoring software is related to improper handling of line separators. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

The vulnerability in the host_templates.php script of the Cacti network monitoring software allows a hacker to execute arbitrary code.

The vulnerability of the hosttemplates.php script of the Cacti network monitoring software is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

The vulnerability of the build_rule_item_filter() function in the api_automation.php script of the Cacti network monitoring software allows a hacker to execute arbitrary code.

The vulnerability of the buildruleitemfilter function in the apiautomation.php script of the Cacti network monitoring software is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary cod...

The vulnerability of the get_discovery_results() function in the Cacti network monitoring software allows a hacker to execute arbitrary code.

The vulnerability of the getdiscoveryresults function in the Cacti network monitoring software is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

The vulnerability of the web interface of the Cacti network monitoring software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the web interface of the Cacti network monitoring software is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Critical Cacti Security Flaw (CVE-2025-22604) Enables Remote Code Execution

A critical security flaw has been disclosed in the Cacti open-source network monitoring and fault management framework that could allow an authenticated attacker to achieve remote code execution on susceptible instances. The flaw, tracked as CVE-2025-22604, carries a CVSS score of 9.1 out of a...

The vulnerability of the functions ss_net_snmp_disk_io() and ss_net_snmp_disk_bytes() in the Cacti network monitoring software allows a attacker to execute arbitrary code.

The vulnerability of the ssnetsnmpdiskio and ssnetsnmpdiskbytes functions of the Cacti network monitoring software is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute...

SUSE CVE-2024-45598

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the Poller Standard Error Log Path parameter in either Installation Step 5 or in Configuration-Settings-Paths tab to a local file inside the server. Then simply going to Logs tab and...

SUSE CVE-2024-54145

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the getdiscoveryresults function of automationdevices.php using the network parameter. This vulnerability is fixed in 1.2.29...

SUSE CVE-2024-54146

Cacti is an open source performance and fault management framework. Cacti has a SQL injection vulnerability in the template function of hosttemplates.php using the graphtemplate parameter. This vulnerability is fixed in 1.2.29...

SUSE CVE-2025-22604

Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OIDs in the response. When processed by ssnetsnmpdiskio or ssnetsnmpdiskbytes, a part of each OID will be used as a key in an array that is...

SUSE CVE-2025-24367

Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed...

SUSE CVE-2025-24368

Cacti is an open source performance and fault management framework. Some of the data stored in automationtreerules.php is not thoroughly checked and is used to concatenate the SQL statement in buildruleitemfilter function from lib/apiautomation.php, resulting in SQL injection. This vulnerability ...

CVE-2025-24367

Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed...