Oracle Linux 7 : qt (ELSA-2020-1172)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1172 advisory. 1:4.8.7-8 - Fix QImage allocation failure in qgifhandler Resolves: bz1667863 - Fix QTgaFile CPU exhaustion Resolves: bz1667879 - Fix QBmpHandler...

CVE-2023-39365

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advise...

Sql injection

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advise...

CVE-2023-30534

Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory phpseclib, the necessary gadgets are not included, making them inaccessible an...

CVE-2023-31132

CVE-2023-31132 affects Cacti, a PHP-based web frontend for monitoring. A privilege-escalation flaw lets a low-privilege OS user with access to a Windows host where Cacti runs create arbitrary PHP files in a web document directory and execute them under SYSTEM, enabling local privilege escalation....

CVE-2023-39513

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

CVE-2023-39364

CVE-2023-39364 (Cacti 1.2.24) describes an open redirect flaw where the auth_changepassword.php script accepts a URL parameter ref and reflects it in the password-change form, using it to redirect via header. This allows users with console access to be redirected to an arbitrary website after ini...

CVE-2023-39365

Cacti vulnerability CVE-2023-39365: Issues with Regular Expression validation combined with the external links feature allow limited SQL injections and data leakage. Affected product is the Cacti framework (web-based network graphing/monitoring). Root cause described as improper validation in reg...

CVE-2023-39365 Unchecked regular expressions can lead to SQL Injection and data leakage in Cacti

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advise...

CVE-2023-39357

Cacti is an open source operational monitoring and fault management framework. A defect in the sqlsave function was discovered. When the column type is numeric, the sqlsave function directly utilizes user input. Many files and functions calling the sqlsave function do not perform prior validation...

CVE-2023-39357

CVE-2023-39357 affects Cacti. A defect in the sql_save function allows SQL injection when the column type is numeric, due to insufficient input validation across call sites. This can enable authenticated users to perform privilege escalation and remote code execution. The issue is addressed in ve...

CVE-2023-39358

CVE-2023-39358 affects Cacti. An authenticated SQL injection in the reports_user.php module (in ajax_get_branches via tree_id) allows privilege escalation and remote code execution due to unvalidated input. Impact: high. Remediation: upgrade to Cacti 1.2.25 (or newer). If upgrading, verify that t...

CVE-2023-39359 Authenticated SQL injection vulnerability in graphs.php in Cacti

Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the graphs.php file. When dealing wit...

CVE-2023-39359

CVE-2023-39359 affects the Cacti monitoring framework. An authenticated SQL injection exists in the graphs.php handler (ajax_hosts / ajax_hosts_noany) where a non-zero site_id is reflected in the WHERE clause, enabling privilege escalation and remote code execution per the cited description. The ...

CVE-2023-39361

CVE-2023-39361 affects Cacti (notably 1.2.24) via a SQL injection in graph_view.php. The vulnerability arises when guest users can access graph_view.php without authentication, enabling an attacker to inject SQL through the rfilter parameter (within the grow_right_pane_tree path) and potentially ...

CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graphview.php. Since guest users can access graphview.php without authentication by default, if guest users are being utilized in an enabled state, there...

CVE-2023-39360 Reflected Cross-site Scripting in graphs_new.php in Cacti

Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data. The vulnerability is found in graphsnew.php. Several validations are performed, but the...

CVE-2023-39360

Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data. The vulnerability is found in graphsnew.php. Several validations are performed, but the...

CVE-2023-39366

CVE-2023-39366 affects Cacti (web-based monitoring) with a stored XSS in the data_sources view caused by malicious device-name configuration via host.php; the payload can execute in admin users’ browsers when viewing data sources. Affected versions are mitigated by upgrading to Cacti 1.2.25. If u...

CVE-2023-39512

CVE-2023-39512 affects Cacti web monitoring software. A stored XSS exists in the data_sources.php output when an authenticated user configures a malicious device name via host.php, allowing injected JavaScript to execute in admin views at view-time. The vulnerability relies on data poisoned by th...