Debian Cacti vulnerabilities

CVE-2016-3659 [HIGH] CVE-2016-3659: cacti - SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote aut... SQL injection vulnerability in graph_view.php in Cacti 0.8.8.g allows remote authenticated users to execute arbitrary SQL commands via the host_group_data parameter. Scope: local bookworm: resolved (fixed in 0.8.8h+ds1-1) bullseye: resolved (fixed in 0.8.8h+ds1-1) forky: resolved (fixed in 0.8.8h+ds1-1) sid: resolved (fixed in 0.8.8h+ds1-1) trixie: resolved (fixed in 0.

CVE-2015-4342 [HIGH] CVE-2015-4342: cacti - SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to ex... SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id. Scope: local bookworm: resolved (fixed in 0.8.8d+ds1-1) bullseye: resolved (fixed in 0.8.8d+ds1-1) forky: resolved (fixed in 0.8.8d+ds1-1) sid: resolved (fixed in 0.8.8d+ds1-1) trixie: resolved (fixed in 0.8.8d+ds1-1)

CVE-2015-4454 [HIGH] CVE-2015-4454: cacti - SQL injection vulnerability in the get_hash_graph_template function in lib/funct... SQL injection vulnerability in the get_hash_graph_template function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graph_template_id parameter to graph_templates.php. Scope: local bookworm: resolved (fixed in 0.8.8d+ds1-1) bullseye: resolved (fixed in 0.8.8d+ds1-1) forky: resolved (fixed in 0.8.8d+ds1-1) sid

CVE-2015-8604 [HIGH] CVE-2015-8604: cacti - SQL injection vulnerability in the host_new_graphs function in graphs_new.php in... SQL injection vulnerability in the host_new_graphs function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via the cg_g parameter in a save action. Scope: local bookworm: resolved (fixed in 0.8.8f+ds1-4) bullseye: resolved (fixed in 0.8.8f+ds1-4) forky: resolved (fixed in 0.8.8f+ds1-4) sid: resolved (fix

CVE-2015-4634 [HIGH] CVE-2015-4634: cacti - SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote a... SQL injection vulnerability in graphs.php in Cacti before 0.8.8e allows remote attackers to execute arbitrary SQL commands via the local_graph_id parameter. Scope: local bookworm: resolved (fixed in 0.8.8e+ds1-1) bullseye: resolved (fixed in 0.8.8e+ds1-1) forky: resolved (fixed in 0.8.8e+ds1-1) sid: resolved (fixed in 0.8.8e+ds1-1) trixie: resolved (fixed in 0.8.8e+ds1-

CVE-2015-8369 [HIGH] CVE-2015-8369: cacti - SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and ... SQL injection vulnerability in include/top_graph_header.php in Cacti 0.8.8f and earlier allows remote attackers to execute arbitrary SQL commands via the rra_id parameter in a properties action to graph.php. Scope: local bookworm: resolved (fixed in 0.8.8f+ds1-3) bullseye: resolved (fixed in 0.8.8f+ds1-3) forky: resolved (fixed in 0.8.8f+ds1-3) sid: resolved (fixed in 0

CVE-2015-0916 [HIGH] CVE-2015-0916: cacti - SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote au... SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035. Scope: local bookworm: resolved (fixed in 0.8.6f-1) bullseye: resolved (fixed in 0.8.6f-1) forky: resolved (fixed in 0.8.6f-1) sid: resolved (fixed in 0.8.6f-1)

CVE-2015-2665 [MEDIUM] CVE-2015-2665: cacti - Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote at... Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Scope: local bookworm: resolved (fixed in 0.8.8d+ds1-1) bullseye: resolved (fixed in 0.8.8d+ds1-1) forky: resolved (fixed in 0.8.8d+ds1-1) sid: resolved (fixed in 0.8.8d+ds1-1) trixie: resolved (fixed in 0.8.8d+ds1-1)

CVE-2015-8377 [MEDIUM] CVE-2015-8377: cacti - SQL injection vulnerability in the host_new_graphs_save function in graphs_new.p... SQL injection vulnerability in the host_new_graphs_save function in graphs_new.php in Cacti 0.8.8f and earlier allows remote authenticated users to execute arbitrary SQL commands via crafted serialized data in the selected_graphs_array parameter in a save action. Scope: local bookworm: resolved (fixed in 0.8.8f+ds1-4) bullseye: resolved (fixed in 0.8.8f+ds1-4) forky:

CVE-2015-2967 [MEDIUM] CVE-2015-2967: cacti - Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d ... Cross-site scripting (XSS) vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Scope: local bookworm: resolved (fixed in 0.8.8d+ds1-1) bullseye: resolved (fixed in 0.8.8d+ds1-1) forky: resolved (fixed in 0.8.8d+ds1-1) sid: resolved (fixed in 0.8.8d+ds1-1) trixie: resolved (fixed i

CVE-2014-2708 [HIGH] CVE-2014-2708: cacti - Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8... Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3) graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id parameter. Scope: local bookworm: resolved (fixed in 0.8.8b+dfsg-4) bulls

CVE-2014-5261 [HIGH] CVE-2014-5261: cacti - The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allow... The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php. Scope: local bookworm: resolved (fixed in 0.8.8b+dfsg-8) bullseye: resolved (fixed in 0.8.8b+dfsg-8) forky: resolved (fixed in 0.8.8b+dfsg-8) sid: reso

CVE-2014-2709 [HIGH] CVE-2014-2709: cacti - lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to exec... lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters. Scope: local bookworm: resolved (fixed in 0.8.8b+dfsg-4) bullseye: resolved (fixed in 0.8.8b+dfsg-4) forky: resolved (fixed in 0.8.8b+dfsg-4) sid: resolved (fixed in 0.8.8b+dfsg-4) trixie: resolved (fixed in 0.8.8b+df

CVE-2014-5262 [HIGH] CVE-2014-5262: cacti - SQL injection vulnerability in the graph settings script (graph_settings.php) in... SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Scope: local bookworm: resolved (fixed in 0.8.8b+dfsg-8) bullseye: resolved (fixed in 0.8.8b+dfsg-8) forky: resolved (fixed in 0.8.8b+dfsg-8) sid: resolved (fixed in 0.8.8b+dfsg-8) tr

CVE-2014-2328 [MEDIUM] CVE-2014-2328: cacti - lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenti... lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors. Scope: local bookworm: resolved (fixed in 0.8.8b+dfsg-4) bullseye: resolved (fixed in 0.8.8b+dfsg-4) forky: resolved (fixed in 0.8.8b+dfsg-4) sid: resolved (fixed in 0.8.8b+dfsg-4) trixie: resolved (

CVE-2014-4002 [MEDIUM] CVE-2014-4002: cacti - Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote... Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3) data_queries.php, (4) data_sources.php, (5) data_templates.php, (6) graph_templates.php, (7) graphs.php, (8) host.php, or (9) host_templates.php or the (10) graph_templat

CVE-2014-2327 [MEDIUM] CVE-2014-2327: cacti - Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and ear... Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users. Scope: local bookworm: resolved (fixed in 0.8.8b+dfsg-6) bullseye: resolved (fixed i

CVE-2014-2326 [MEDIUM] CVE-2014-2326: cacti - Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, an... Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Scope: local bookworm: resolved (fixed in 0.8.8b+dfsg-4) bullseye: resolved (fixed in 0.8.8b+dfsg-4) forky: resolved (fixed in 0.8.8b+dfsg-4) sid: resolved (fixed in 0.8.8b+dfsg-4) trixie: res

CVE-2014-5025 [LOW] CVE-2014-5025: cacti - Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b all... Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the name_cache parameter in a ds_edit action. Scope: local bookworm: resolved (fixed in 0.8.8b+dfsg-7) bullseye: resolved (fixed in 0.8.8b+dfsg-7) forky: resolved (fixed in 0.8.8b+dfsg-7) sid: resolv

CVE-2014-5026 [LOW] CVE-2014-5026: cacti - Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote... Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Na