Vulnerabilities > THE Cacti Group
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2007-06-07 | CVE-2007-3113 | Denial-Of-Service vulnerability in Cacti Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_height or (2) graph_width parameter, different vectors than CVE-2007-3112. | 6.8 |
| 2007-06-07 | CVE-2007-3112 | Denial-Of-Service vulnerability in Cacti graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113. | 7.8 |
| 2006-12-28 | CVE-2006-6799 | Remote Command Execution vulnerability in Cacti CMD.PHP SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php. | 7.5 |
| 2006-01-09 | CVE-2006-0147 | Remote Security vulnerability in Moodle Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo. | 7.5 |
| 2005-07-06 | CVE-2005-2149 | Unspecified vulnerability in the Cacti Group Cacti config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks. | 10.0 |
| 2005-07-06 | CVE-2005-2148 | SQL Injection vulnerability in RaXnet Cacti Input Filter Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php. | 7.5 |
| 2005-06-22 | CVE-2005-1526 | Remote File Include vulnerability in RaXnet Cacti Config_Settings.PHP PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter. | 7.5 |
| 2005-06-22 | CVE-2005-1525 | SQL Injection vulnerability in RaXnet Cacti SQL injection vulnerability in config_settings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter. | 7.5 |
| 2005-06-22 | CVE-2005-1524 | Unspecified vulnerability in the Cacti Group Cacti PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the config[library_path] parameter. | 5.0 |
| 2004-12-31 | CVE-2004-1736 | Unspecified vulnerability in the Cacti Group Cacti 0.8.5A Cacti 0.8.5a allows remote attackers to gain sensitive information via an HTTP request to (1) auth.php, (2) auth_login.php, (3) auth_changepassword.php, and possibly other php files, which reveal the installation path in a PHP error message. | 5.0 |