OPENSUSE-SU-2024:10670-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Summary
cacti-1.2.18-1.2 on GA media
Severity
Moderate
Notes
Title of the patch: cacti-1.2.18-1.2 on GA media
Description of the patch: These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-10670
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.4 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.4 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.4 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
9.8 (Critical)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.1 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.4 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.1 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.2 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.2 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
4.9 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.1 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
4.8 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
4.8 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
4.8 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
5.4 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
4.3 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.5 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.1 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.1 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.5 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
7.2 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.1 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.1 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
6.1 (Medium)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
8.8 (High)
Vendor Fix
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
References
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "cacti-1.2.18-1.2 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the cacti-1.2.18-1.2 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-10670",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10670-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2006-6799 page",
"url": "https://www.suse.com/security/cve/CVE-2006-6799/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2007-3112 page",
"url": "https://www.suse.com/security/cve/CVE-2007-3112/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2009-4112 page",
"url": "https://www.suse.com/security/cve/CVE-2009-4112/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-4000 page",
"url": "https://www.suse.com/security/cve/CVE-2014-4000/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-10970 page",
"url": "https://www.suse.com/security/cve/CVE-2017-10970/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-11163 page",
"url": "https://www.suse.com/security/cve/CVE-2017-11163/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-11691 page",
"url": "https://www.suse.com/security/cve/CVE-2017-11691/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-12065 page",
"url": "https://www.suse.com/security/cve/CVE-2017-12065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-12927 page",
"url": "https://www.suse.com/security/cve/CVE-2017-12927/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-12978 page",
"url": "https://www.suse.com/security/cve/CVE-2017-12978/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-15194 page",
"url": "https://www.suse.com/security/cve/CVE-2017-15194/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16641 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16641/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16660 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16660/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16661 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16661/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16785 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16785/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20723 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20724 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20724/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20725 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20725/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-20726 page",
"url": "https://www.suse.com/security/cve/CVE-2018-20726/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-16723 page",
"url": "https://www.suse.com/security/cve/CVE-2019-16723/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17357 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17357/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-17358 page",
"url": "https://www.suse.com/security/cve/CVE-2019-17358/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11022 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11022/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-13625 page",
"url": "https://www.suse.com/security/cve/CVE-2020-13625/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14295 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14295/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-14424 page",
"url": "https://www.suse.com/security/cve/CVE-2020-14424/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-25706 page",
"url": "https://www.suse.com/security/cve/CVE-2020-25706/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-35701 page",
"url": "https://www.suse.com/security/cve/CVE-2020-35701/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7106 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7106/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-7237 page",
"url": "https://www.suse.com/security/cve/CVE-2020-7237/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-8813 page",
"url": "https://www.suse.com/security/cve/CVE-2020-8813/"
}
],
"title": "cacti-1.2.18-1.2 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:10670-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.aarch64",
"product": {
"name": "cacti-1.2.18-1.2.aarch64",
"product_id": "cacti-1.2.18-1.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.ppc64le",
"product": {
"name": "cacti-1.2.18-1.2.ppc64le",
"product_id": "cacti-1.2.18-1.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.s390x",
"product": {
"name": "cacti-1.2.18-1.2.s390x",
"product_id": "cacti-1.2.18-1.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "cacti-1.2.18-1.2.x86_64",
"product": {
"name": "cacti-1.2.18-1.2.x86_64",
"product_id": "cacti-1.2.18-1.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64"
},
"product_reference": "cacti-1.2.18-1.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le"
},
"product_reference": "cacti-1.2.18-1.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x"
},
"product_reference": "cacti-1.2.18-1.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cacti-1.2.18-1.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
},
"product_reference": "cacti-1.2.18-1.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2006-6799",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2006-6799"
}
],
"notes": [
{
"category": "general",
"text": "SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. NOTE: this issue can be leveraged to execute arbitrary commands since the SQL query results are later used in the polling_items array and popen function.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2006-6799",
"url": "https://www.suse.com/security/cve/CVE-2006-6799"
},
{
"category": "external",
"summary": "SUSE Bug 231082 for CVE-2006-6799",
"url": "https://bugzilla.suse.com/231082"
},
{
"category": "external",
"summary": "SUSE Bug 236724 for CVE-2006-6799",
"url": "https://bugzilla.suse.com/236724"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2006-6799"
},
{
"cve": "CVE-2007-3112",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2007-3112"
}
],
"notes": [
{
"category": "general",
"text": "graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2007-3112",
"url": "https://www.suse.com/security/cve/CVE-2007-3112"
},
{
"category": "external",
"summary": "SUSE Bug 326228 for CVE-2007-3112",
"url": "https://bugzilla.suse.com/326228"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2007-3112"
},
{
"cve": "CVE-2009-4112",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2009-4112"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the \"Data Input Method\" for the \"Linux - Get Memory Usage\" setting to contain arbitrary commands.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2009-4112",
"url": "https://www.suse.com/security/cve/CVE-2009-4112"
},
{
"category": "external",
"summary": "SUSE Bug 1122535 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/1122535"
},
{
"category": "external",
"summary": "SUSE Bug 558664 for CVE-2009-4112",
"url": "https://bugzilla.suse.com/558664"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2009-4112"
},
{
"cve": "CVE-2014-4000",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-4000"
}
],
"notes": [
{
"category": "general",
"text": "Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-4000",
"url": "https://www.suse.com/security/cve/CVE-2014-4000"
},
{
"category": "external",
"summary": "SUSE Bug 1022564 for CVE-2014-4000",
"url": "https://bugzilla.suse.com/1022564"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2014-4000"
},
{
"cve": "CVE-2017-10970",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-10970"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the die_html_input_error function in lib/html_validate.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-10970",
"url": "https://www.suse.com/security/cve/CVE-2017-10970"
},
{
"category": "external",
"summary": "SUSE Bug 1047512 for CVE-2017-10970",
"url": "https://bugzilla.suse.com/1047512"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-10970"
},
{
"cve": "CVE-2017-11163",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-11163"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in aggregate_graphs.php in Cacti 1.1.12 allows remote authenticated users to inject arbitrary web script or HTML via specially crafted HTTP Referer headers, related to the $cancel_url variable.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-11163",
"url": "https://www.suse.com/security/cve/CVE-2017-11163"
},
{
"category": "external",
"summary": "SUSE Bug 1048102 for CVE-2017-11163",
"url": "https://bugzilla.suse.com/1048102"
},
{
"category": "external",
"summary": "SUSE Bug 1051633 for CVE-2017-11163",
"url": "https://bugzilla.suse.com/1051633"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-11163"
},
{
"cve": "CVE-2017-11691",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-11691"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-11691",
"url": "https://www.suse.com/security/cve/CVE-2017-11691"
},
{
"category": "external",
"summary": "SUSE Bug 1050950 for CVE-2017-11691",
"url": "https://bugzilla.suse.com/1050950"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-11691"
},
{
"cve": "CVE-2017-12065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-12065"
}
],
"notes": [
{
"category": "general",
"text": "spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-12065",
"url": "https://www.suse.com/security/cve/CVE-2017-12065"
},
{
"category": "external",
"summary": "SUSE Bug 1051633 for CVE-2017-12065",
"url": "https://bugzilla.suse.com/1051633"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2017-12065"
},
{
"cve": "CVE-2017-12927",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-12927"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting vulnerability exists in Cacti 1.1.17 in the method parameter in spikekill.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-12927",
"url": "https://www.suse.com/security/cve/CVE-2017-12927"
},
{
"category": "external",
"summary": "SUSE Bug 1054390 for CVE-2017-12927",
"url": "https://bugzilla.suse.com/1054390"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2017-12927"
},
{
"cve": "CVE-2017-12978",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-12978"
}
],
"notes": [
{
"category": "general",
"text": "lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-12978",
"url": "https://www.suse.com/security/cve/CVE-2017-12978"
},
{
"category": "external",
"summary": "SUSE Bug 1054742 for CVE-2017-12978",
"url": "https://bugzilla.suse.com/1054742"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-12978"
},
{
"cve": "CVE-2017-15194",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-15194"
}
],
"notes": [
{
"category": "general",
"text": "include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-15194",
"url": "https://www.suse.com/security/cve/CVE-2017-15194"
},
{
"category": "external",
"summary": "SUSE Bug 1062554 for CVE-2017-15194",
"url": "https://bugzilla.suse.com/1062554"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-15194"
},
{
"cve": "CVE-2017-16641",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16641"
}
],
"notes": [
{
"category": "general",
"text": "lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16641",
"url": "https://www.suse.com/security/cve/CVE-2017-16641"
},
{
"category": "external",
"summary": "SUSE Bug 1067166 for CVE-2017-16641",
"url": "https://bugzilla.suse.com/1067166"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-16641"
},
{
"cve": "CVE-2017-16660",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16660"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16660",
"url": "https://www.suse.com/security/cve/CVE-2017-16660"
},
{
"category": "external",
"summary": "SUSE Bug 1067164 for CVE-2017-16660",
"url": "https://bugzilla.suse.com/1067164"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-16660"
},
{
"cve": "CVE-2017-16661",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16661"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16661",
"url": "https://www.suse.com/security/cve/CVE-2017-16661"
},
{
"category": "external",
"summary": "SUSE Bug 1067163 for CVE-2017-16661",
"url": "https://bugzilla.suse.com/1067163"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-16661"
},
{
"cve": "CVE-2017-16785",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16785"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16785",
"url": "https://www.suse.com/security/cve/CVE-2017-16785"
},
{
"category": "external",
"summary": "SUSE Bug 1068028 for CVE-2017-16785",
"url": "https://bugzilla.suse.com/1068028"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-16785"
},
{
"cve": "CVE-2018-20723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20723"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Name field for a Color.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20723",
"url": "https://www.suse.com/security/cve/CVE-2018-20723"
},
{
"category": "external",
"summary": "SUSE Bug 1122245 for CVE-2018-20723",
"url": "https://bugzilla.suse.com/1122245"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20723"
},
{
"cve": "CVE-2018-20724",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20724"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname for Data Collectors.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20724",
"url": "https://www.suse.com/security/cve/CVE-2018-20724"
},
{
"category": "external",
"summary": "SUSE Bug 1122244 for CVE-2018-20724",
"url": "https://bugzilla.suse.com/1122244"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20724"
},
{
"cve": "CVE-2018-20725",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20725"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Graph Vertical Label.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20725",
"url": "https://www.suse.com/security/cve/CVE-2018-20725"
},
{
"category": "external",
"summary": "SUSE Bug 1122243 for CVE-2018-20725",
"url": "https://bugzilla.suse.com/1122243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20725"
},
{
"cve": "CVE-2018-20726",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-20726"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escaping of unintended characters in the Website Hostname field for Devices.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-20726",
"url": "https://www.suse.com/security/cve/CVE-2018-20726"
},
{
"category": "external",
"summary": "SUSE Bug 1122242 for CVE-2018-20726",
"url": "https://bugzilla.suse.com/1122242"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-20726"
},
{
"cve": "CVE-2019-16723",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-16723"
}
],
"notes": [
{
"category": "general",
"text": "In Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-16723",
"url": "https://www.suse.com/security/cve/CVE-2019-16723"
},
{
"category": "external",
"summary": "SUSE Bug 1151788 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1151788"
},
{
"category": "external",
"summary": "SUSE Bug 1214170 for CVE-2019-16723",
"url": "https://bugzilla.suse.com/1214170"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-16723"
},
{
"cve": "CVE-2019-17357",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17357"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifiers are handled when a string and id composite value are used to identify the template type and id. An authenticated attacker can exploit this to extract data from the database, or an unauthenticated remote attacker could exploit this via Cross-Site Request Forgery.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17357",
"url": "https://www.suse.com/security/cve/CVE-2019-17357"
},
{
"category": "external",
"summary": "SUSE Bug 1158990 for CVE-2019-17357",
"url": "https://bugzilla.suse.com/1158990"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-17357"
},
{
"cve": "CVE-2019-17358",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-17358"
}
],
"notes": [
{
"category": "general",
"text": "Cacti through 1.2.7 is affected by multiple instances of lib/functions.php unsafe deserialization of user-controlled data to populate arrays. An authenticated attacker could use this to influence object data values and control actions taken by Cacti or potentially cause memory corruption in the PHP module.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-17358",
"url": "https://www.suse.com/security/cve/CVE-2019-17358"
},
{
"category": "external",
"summary": "SUSE Bug 1158992 for CVE-2019-17358",
"url": "https://bugzilla.suse.com/1158992"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-17358"
},
{
"cve": "CVE-2020-11022",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11022"
}
],
"notes": [
{
"category": "general",
"text": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11022",
"url": "https://www.suse.com/security/cve/CVE-2020-11022"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1173090"
},
{
"category": "external",
"summary": "SUSE Bug 1178434 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1178434"
},
{
"category": "external",
"summary": "SUSE Bug 1190663 for CVE-2020-11022",
"url": "https://bugzilla.suse.com/1190663"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-11022"
},
{
"cve": "CVE-2020-13625",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-13625"
}
],
"notes": [
{
"category": "general",
"text": "PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result in the file type being misinterpreted by the receiver or any mail relay processing the message.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-13625",
"url": "https://www.suse.com/security/cve/CVE-2020-13625"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-13625",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-13625"
},
{
"cve": "CVE-2020-14295",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14295"
}
],
"notes": [
{
"category": "general",
"text": "A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14295",
"url": "https://www.suse.com/security/cve/CVE-2020-14295"
},
{
"category": "external",
"summary": "SUSE Bug 1173090 for CVE-2020-14295",
"url": "https://bugzilla.suse.com/1173090"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-14295"
},
{
"cve": "CVE-2020-14424",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-14424"
}
],
"notes": [
{
"category": "general",
"text": "Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-14424",
"url": "https://www.suse.com/security/cve/CVE-2020-14424"
},
{
"category": "external",
"summary": "SUSE Bug 1188188 for CVE-2020-14424",
"url": "https://bugzilla.suse.com/1188188"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-14424"
},
{
"cve": "CVE-2020-25706",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-25706"
}
],
"notes": [
{
"category": "general",
"text": "A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-25706",
"url": "https://www.suse.com/security/cve/CVE-2020-25706"
},
{
"category": "external",
"summary": "SUSE Bug 1174850 for CVE-2020-25706",
"url": "https://bugzilla.suse.com/1174850"
},
{
"category": "external",
"summary": "SUSE Bug 1178677 for CVE-2020-25706",
"url": "https://bugzilla.suse.com/1178677"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-25706"
},
{
"cve": "CVE-2020-35701",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-35701"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-35701",
"url": "https://www.suse.com/security/cve/CVE-2020-35701"
},
{
"category": "external",
"summary": "SUSE Bug 1180804 for CVE-2020-35701",
"url": "https://bugzilla.suse.com/1180804"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-35701"
},
{
"cve": "CVE-2020-7106",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7106"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7106",
"url": "https://www.suse.com/security/cve/CVE-2020-7106"
},
{
"category": "external",
"summary": "SUSE Bug 1163749 for CVE-2020-7106",
"url": "https://bugzilla.suse.com/1163749"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-7106"
},
{
"cve": "CVE-2020-7237",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-7237"
}
],
"notes": [
{
"category": "general",
"text": "Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance Settings of the product.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-7237",
"url": "https://www.suse.com/security/cve/CVE-2020-7237"
},
{
"category": "external",
"summary": "SUSE Bug 1161297 for CVE-2020-7237",
"url": "https://bugzilla.suse.com/1161297"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-7237"
},
{
"cve": "CVE-2020-8813",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-8813"
}
],
"notes": [
{
"category": "general",
"text": "graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-8813",
"url": "https://www.suse.com/security/cve/CVE-2020-8813"
},
{
"category": "external",
"summary": "SUSE Bug 1154087 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1154087"
},
{
"category": "external",
"summary": "SUSE Bug 1160867 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1160867"
},
{
"category": "external",
"summary": "SUSE Bug 1164675 for CVE-2020-8813",
"url": "https://bugzilla.suse.com/1164675"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:cacti-1.2.18-1.2.aarch64",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.ppc64le",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.s390x",
"openSUSE Tumbleweed:cacti-1.2.18-1.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2020-8813"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…