Vulnerabilities > THE Cacti Group

DATE CVE VULNERABILITY TITLE RISK
2007-06-07 CVE-2007-3113 Denial-Of-Service vulnerability in Cacti
Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_height or (2) graph_width parameter, different vectors than CVE-2007-3112.
network
low complexity
the-cacti-group
6.8
2007-06-07 CVE-2007-3112 Denial-Of-Service vulnerability in Cacti
graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU consumption) via a large value of the (1) graph_start or (2) graph_end parameter, different vectors than CVE-2007-3113.
network
low complexity
the-cacti-group
7.8
2006-12-28 CVE-2006-6799 Remote Command Execution vulnerability in Cacti CMD.PHP
SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote attackers to execute arbitrary SQL commands via the (1) second or (2) third arguments to cmd.php.
network
low complexity
the-cacti-group
7.5
2006-01-09 CVE-2006-0147 Remote Security vulnerability in Moodle
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.
7.5
2006-01-09 CVE-2006-0146 SQL Injection vulnerability in multiple products
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
7.5
2005-07-06 CVE-2005-2149 Unspecified vulnerability in the Cacti Group Cacti
config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify session information to gain privileges and disable the use of addslashes to conduct SQL injection attacks.
network
low complexity
the-cacti-group
critical
10.0
2005-07-06 CVE-2005-2148 SQL Injection vulnerability in RaXnet Cacti Input Filter
Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which allows remote attackers to execute arbitrary commands or SQL by sending a legitimate value in a POST request or cookie, then specifying the attack string in the URL, which causes the get_request_var function to return the wrong value in the $_REQUEST variable, which is cleansed while the original malicious $_GET value remains unmodified, as demonstrated in (1) graph_image.php and (2) graph.php.
network
low complexity
the-cacti-group
7.5
2005-06-22 CVE-2005-1526 Remote File Include vulnerability in RaXnet Cacti Config_Settings.PHP
PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers to execute arbitrary PHP code via the config[include_path] parameter.
network
low complexity
the-cacti-group
7.5
2005-06-22 CVE-2005-1525 SQL Injection vulnerability in RaXnet Cacti
SQL injection vulnerability in config_settings.php for Cacti before 0.8.6e allows remote attackers to execute arbitrary SQL commands via the id parameter.
network
low complexity
the-cacti-group
7.5
2005-06-22 CVE-2005-1524 Unspecified vulnerability in the Cacti Group Cacti
PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the config[library_path] parameter.
network
low complexity
the-cacti-group
5.0