Published: 23/08/2010 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti prior to 0.8.7g allows remote malicious users to inject arbitrary web script or HTML via the graph_start parameter to graph.php. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cacti cacti 0.5
cacti cacti 0.8.6k
cacti cacti 0.8.6d
cacti cacti 0.6.3
cacti cacti
cacti cacti 0.8.7
cacti cacti 0.8.5a
cacti cacti 0.8.3
cacti cacti 0.6.8
cacti cacti 0.8.2
cacti cacti 0.8.5
cacti cacti 0.6.6
cacti cacti 0.8.7d
cacti cacti 0.8.7b
cacti cacti 0.8.7a
cacti cacti 0.6.2
cacti cacti 0.6.5
cacti cacti 0.8.6f
cacti cacti 0.8.6g
cacti cacti 0.8.6j
cacti cacti 0.8.7c
cacti cacti 0.6.1
cacti cacti 0.8
cacti cacti 0.8.7e
cacti cacti 0.8.6a
cacti cacti 0.8.6i
cacti cacti 0.8.6
cacti cacti 0.6.8a
cacti cacti 0.6.7
cacti cacti 0.8.1
cacti cacti 0.8.4
cacti cacti 0.8.6c
cacti cacti 0.6.4
cacti cacti 0.8.6b
cacti cacti 0.8.2a
cacti cacti 0.8.3a
cacti cacti 0.8.6h
cacti cacti 0.6

Debian Bug report logs - #652371 [CVE-2011-4824] SQL injection issue in auth_loginphp Package: cacti; Maintainer for cacti is Cacti Maintainer <pkg-cacti-maint@listsaliothdebianorg>; Source for cacti is src:cacti (PTS, buildd, popcon) Reported by: Florian Weimer <fw@denebenyode> Date: Fri, 16 Dec 2011 20:09:02 ...

Debian Bug report logs - #742768 cacti: CVE-2014-2326 CVE-2014-2327 CVE-2014-2328 Package: cacti; Maintainer for cacti is Cacti Maintainer <pkg-cacti-maint@listsaliothdebianorg>; Source for cacti is src:cacti (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Thu, 27 Mar 2014 07:03:01 UTC ...

Several vulnerabilities have been discovered in Cacti, a graphing tool for monitoring data Multiple cross site scripting issues allow remote attackers to inject arbitrary web script or HTML An SQL injection vulnerability allows remote attackers to execute arbitrary SQL commands For the oldstable distribution (lenny), this problem has been fixed ...

Moritz Naumann <security@moritz-naumanncom> cacti: wwwcactinet/ ================================================================= Cacti 087e and earlier versions are affected by multiple security issues Issues 1-4 are cross site scripting issues, issue 5 is a priviledge escalation issue 1 XSS 1 A HTTP GET request against ...

CWE-79 http://marc.info/?l=oss-security&m=127978954522586&w=2 http://marc.info/?l=oss-security&m=128017203704299&w=2 https://bugzilla.redhat.com/show_bug.cgi?id=541279 http://svn.cacti.net/viewvc/cacti/branches/0.8.7/include/top_graph_header.php?r1=6025&r2=6024 http://cacti.net/release_notes_0_8_7g.php http://svn.cacti.net/viewvc?view=rev&revision=6025 http://www.mandriva.com/security/advisories?name=MDVSA-2010:160 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652371 https://www.exploit-db.com/exploits/10234/https://www.debian.org/security/./dsa-2384

CVE-2010-2543

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect