CVE-2023-39516

CVE-2023-39516 affects Cacti. It is a Stored Cross-Site Scripting (XSS) vulnerability in the data_sources.php component that can be exploited by an authenticated user with the General Administration > Sites/Devices/Data permission to poison data stored in the Cacti database. The poisoned data ...

CVE-2023-39516

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

CVE-2023-39357

CVE-2023-39357 affects Cacti. A defect in the sql_save function allows SQL injection when the column type is numeric, due to insufficient input validation across call sites. This can enable authenticated users to perform privilege escalation and remote code execution. The issue is addressed in ve...

CVE-2023-39359

CVE-2023-39359 affects the Cacti monitoring framework. An authenticated SQL injection exists in the graphs.php handler (ajax_hosts / ajax_hosts_noany) where a non-zero site_id is reflected in the WHERE clause, enabling privilege escalation and remote code execution per the cited description. The ...

CVE-2023-39361

CVE-2023-39361 affects Cacti (notably 1.2.24) via a SQL injection in graph_view.php. The vulnerability arises when guest users can access graph_view.php without authentication, enabling an attacker to inject SQL through the rfilter parameter (within the grow_right_pane_tree path) and potentially ...

CVE-2023-39360

CVE-2023-39360 is a stored XSS in Cacti’s graphs_new.php. An authenticated user can poison stored data via the returnto parameter passed to form_save_button; bypass occurs when returnto contains host.php. The issue affects Cacti prior to the fixed release and can impact data integrity and user se...

CVE-2023-39360 Reflected Cross-site Scripting in graphs_new.php in Cacti

Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data. The vulnerability is found in graphsnew.php. Several validations are performed, but the...

CVE-2023-39510

CVE-2023-39510 affects Cacti prior to 1.2.25, enabling a stored XSS via malicious device names configured in host.php and rendered in reports_admin.php, viewable by admins with High privileges. The vulnerability relies on insufficient output filtering so that an authenticated user can poison data...

CVE-2023-39512

CVE-2023-39512 affects Cacti web monitoring software. A stored XSS exists in the data_sources.php output when an authenticated user configures a malicious device name via host.php, allowing injected JavaScript to execute in admin views at view-time. The vulnerability relies on data poisoned by th...

CVE-2023-39512 Stored Cross-site Scripting on data_sources.php device name view in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

CVE-2023-39513

CVE-2023-39513 affects Cacti (web-based network monitoring). A stored XSS exists via the data_queries template path; an authenticated user with Data Queries/Template Editor rights can inject code that is rendered in the host/php view, potentially executing JavaScript in admin contexts. The vulner...

CVE-2023-39515 Stored Cross-site Scripting on data_debug.php datasource path view in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...

CVE-2023-39514

Cacti (web-based graphing/monitoring tool) is affected by CVE-2023-39514 due to a stored XSS vulnerability in the graphs view. A authenticated user with appropriate privileges can poison data in the Cacti database by injecting malicious content into data-source names or device names via data_temp...

[SECURITY] Fedora 38 Update: python-pyramid-2.0.2-1.fc38

Pyramid is a small, fast, down-to-earth, open source Python web development framework. It makes real-world web application development and deployment more fun, more predictable, and more productive...

Cerebrate security breach

Cerebrate is an open source platform. It is intended to act as an interconnection coordinator between trusted contact information providers and other security tools. A security vulnerability exists in Cerebrate that stems from the lack of a Secure attribute on session cookies...

GPAC Buffer Error Vulnerability

GPAC is an open source multimedia framework. A buffer error vulnerability exists in versions prior to GPAC 2.3-DEV, which stems from an out-of-bounds memory read problem...

Supply Chain Security Leaders Collaborate to Help Developers Choose Open-Source

Supply Chain Security Leaders Collaborate to Help Developers Choose Open-Source By Trellix, Checkmarx and Illustria · September 05, 2023 Working together to keep open source safe At the beginning of 2023, top researchers from industry-leading companies established the Supply Chain Attack Research...

F-RevoCRM Cross-Site Scripting Vulnerability

Thinkreed F-RevoCRM is an open source customer relationship management software from Thinkreed Japan. A security vulnerability exists in F-RevoCRM that stems from F-RevoCRM allowing cross-site scripting...

Supply Chain Security Leaders Collaborate to Help Developers Choose Open-Source

Supply Chain Security Leaders Collaborate to Help Developers Choose Open-Source By Trellix, Checkmarx and Illustria · September 05, 2023 Working together to keep open source safe At the beginning of 2023, top researchers from industry-leading companies established the Supply Chain Attack Research...

CVE-2023-41049

@dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix. This vulnerability has been patched on version 0.1.0. Users are...