The vulnerability of the SNMP Notification Receiver function in the managers.php script of the Cacti network monitoring software allows a hacker to execute arbitrary SQL code.

The vulnerability of the SNMP Notification Receiver function in the managers.php script of the Cacti network monitoring software is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code by sending...

SUSE CVE-2023-49086

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database TSDB. A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation of the vulnerability is possible for an...

DEBIAN-CVE-2023-51448

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection SQLi vulnerability within the SNMP Notification Receivers feature in the file ‘managers.php’. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTT...

UBUNTU-CVE-2023-51448

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection SQLi vulnerability within the SNMP Notification Receivers feature in the file ‘managers.php’. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTT...

UBUNTU-CVE-2023-49086

Cacti is a robust performance and fault management framework and a frontend to RRDTool - a Time Series Database TSDB. A vulnerability in versions prior to 1.2.27 bypasses an earlier fix for CVE-2023-39360, therefore leading to a DOM XSS attack. Exploitation of the vulnerability is possible for an...

Cacti 跨站脚本漏洞

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . Cacti versions prior to 1.2.26 cross-site scripting vulnerability ,...

GHSA-FPQ5-4VWM-78X4 LibreNMS has Broken Access control on Graphs Feature

Summary This vulnerability occurs when application is not checking access of each type of users as per their role and it autorizing the users to access any feature. When user access his Device dashboard in librenms, one request is going to graph.php to access image of graphs generated on the...

LibreNMS has Broken Access control on Graphs Feature

Summary This vulnerability occurs when application is not checking access of each type of users as per their role and it autorizing the users to access any feature. When user access his Device dashboard in librenms, one request is going to graph.php to access image of graphs generated on the...

CVE-2023-48294 Broken Access control on Graphs Feature in LibreNMS

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions of LibreNMS when a user accesses their device dashboard, one request is sent to graph.php to access graphs generated on t...

GHSA-R7X6-XFCM-3MXV Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are...

PYSEC-2023-231

Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome.Users of Apache Airflow are...

PT-2023-6909 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.7.3 Description: The issue is related to insufficient protection of internal data in Apache Airflow, allowing an authorized user with limited access to read specific DAGs to also read information about task...

Information Disclosure

Apache Airflow is vulnerable to Information Disclosure. The vulnerability is due to a flaw that permits authenticated users to list warnings for all Directed Acyclic Graphs DAG's regardless of their permissions to access such DAG's. This leads to exposure of sensitive information such as dagids a...

PYSEC-2023-202

Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dagids and the stack-traces of import errors for those DAGs with import...

PYSEC-2023-197

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated wit...

PYSEC-2023-203

Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

Cacti 1.2.24 - Authenticated command injection when using SNMP options Vulnerability

Exploit Title: Cacti 1.2.24 - Authenticated command injection when using SNMP options Exploit Author: Antonio Francesco Sardella Vendor Homepage: https://www.cacti.net/ Software Link: https://www.cacti.net/info/downloads Version: Cacti 1.2.24 Tested on: Cacti 1.2.24 installed on 'php:7.4.33-apach...

The vulnerability of the graphs_new.php component in the Cacti network monitoring software allows a hacker to perform cross-site scripting attacks.

The vulnerability of the graphsnew.php component in the Cacti network monitoring software is related to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the ajax_hosts() and ajax_hosts_noany() functions (graphs.php) of the Cacti network monitoring tool allows a hacker to execute arbitrary SQL queries.

The vulnerability of the ajaxhosts and ajaxhostsnoany functions graphs.php of the Cacti network monitoring tool is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries using a specially...

The vulnerability of the `host_new_graphs_save()` function in the Cacti network monitoring software (graphs_new.php) allows a attacker to execute arbitrary code.

The vulnerability of the hostnewgraphssave function in the Cacti network monitoring software’s script graphsnew.php involves the restoration of unreliable data in memory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code using specially...