SUSE CVE-2023-39358

Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the reportsuser.php file. In...

SUSE CVE-2023-39511

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

CVE-2023-39511 Stored Cross-Site-Scripting on reports_admin.php device name in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

DEBIAN-CVE-2023-39358

Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered which allows authenticated users to perform privilege escalation and remote code execution. The vulnerability resides in the reportsuser.php file. In...

DEBIAN-CVE-2023-39510

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...

UBUNTU-CVE-2023-39510

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...

PT-2023-4935 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.25 Description: Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability that allows an authenticated user to...

PT-2023-5425 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.25 Description: An authenticated SQL injection issue allows authenticated users to perform privilege escalation and remote code execution. The issue resides in the reports user.php file, specifically in the ajax ge...

CVE-2020-19625

creationtimestamp| type| source ---|---|--- 2023-09-03 06:24:27+00:00| published-proof-of-concept| https://t.me/CNArsenal/996 2024-01-15 12:57:23+00:00| seen| https://t.me/arpsyndicate/2783 2024-11-04 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2024-11-04 2024-11-05...

Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports

...

CVE-2023-40030 Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports

Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrar...

GHSA-WRRJ-H57R-VX9P Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports

The Rust Security Response WG was notified that Cargo did not escape Cargo feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly arbitrary HTML here, potentially leading to XSS if the report is subsequent...

Docker and Kubernetes, we have got you covered: Wiz simplifies compliance and security posture management for Docker and Kubernetes environments.

Ensure that your Docker and Kubernetes environments are secure and compliant with CIS benchmarks. Generate reports quickly and easily and remediate any issues with actionable insights...

CVE-2023-36845

creationtimestamp| type| source ---|---|--- 2023-08-18 00:37:41+00:00| seen| https://t.me/cibsecurity/68793 2023-08-20 06:53:11+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus14/2023 2023-08-27 15:11:36+00:00| published-proof-of-concept|...

ScienceLogic SL1 Command Execution Vulnerability

ScienceLogic SL1 is an application from ScienceLogic, Inc. Connect your real estate together to automate multidirectional data flow and workflow. A command execution vulnerability exists in ScienceLogic SL1 11.1.2 and earlier versions, which stems from the Download and Convert Reports feature...

Internet Bug Bounty: (CVE-2023-32006) Permissions policies can impersonate other modules in using module.constructor.createRequire()

A vulnerability was discovered in Node.js that allowed permissions policies to impersonate other modules using the module.constructor.createRequire function. This could bypass the policy mechanism and enable the loading of modules outside of the defined policy. The vulnerability affected all user...

CVE-2023-24015

A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. The reports section will be partially unavailable for all later attempts to use it, with the report list seemingly stuck on...

CVE-2023-24015

A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. The reports section will be partially unavailable for all later attempts to use it, with the report list seemingly stuck on...

Code injection

A partial DoS vulnerability has been detected in the Reports section, exploitable by a malicious authenticated user forcing a report to be saved with its name set as null. The reports section will be partially unavailable for all later attempts to use it, with the report list seemingly stuck on...

CVE-2023-24015

CVE-2023-24015 affects Nozomi Guardian and Nozomi CMC prior to v22.6.2. A partial Denial of Service arises when an authenticated user saves a report with the name set to null in the Reports section, causing subsequent loads to stall and the reports list to become partially unavailable. CVSS metri...