VulnerableCode Package Details - pkg:apk/alpine/cacti@1.2.13-r0?arch=ppc64le&distroversion=v3.22&reponame=community

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-16kp-5zpw-fbha	Insufficient output escaping of attachment names in PHPMailer ### Impact CWE-116: Incorrect output escaping. An attachment added like this (note the double quote within the attachment name, which is entirely valid): $mail->addAttachment('/tmp/attachment.tmp', 'filename.html";.jpg'); Will result in a message containing these headers: Content-Type: application/octet-stream; name="filename.html";.jpg" Content-Disposition: attachment; filename="filename.html";.jpg" The attachment will be named `filename.html`, and the trailing `";.jpg"` will be ignored. Mail filters that reject `.html` attachments but permit `.jpg` attachments may be fooled by this. Note that the MIME type itself is obtained automatically from the source filename (in this case `attachment.tmp`, which maps to a generic `application/octet-stream` type), and not the name given to the attachment (though these are the same if a separate name is not provided), though it can be set explicitly in other parameters to attachment methods. ### Patches Patched in PHPMailer 6.1.6 by escaping double quotes within the name using a backslash, as per RFC822 section 3.4.1, resulting in correctly escaped headers like this: Content-Type: application/octet-stream; name="filename.html\";.jpg" Content-Disposition: attachment; filename="filename.html\";.jpg" ### Workarounds Reject or filter names and filenames containing double quote (`"`) characters before passing them to attachment functions such as `addAttachment()`. ### References [CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625). [PHPMailer 6.1.6 release](https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6) ### For more information If you have any questions or comments about this advisory: * Open an issue in [the PHPMailer repo](https://github.com/PHPMailer/PHPMailer/issues)	CVE-2020-13625 GHSA-f7hx-fqxw-rvvj
VCID-5618-53yg-8qh4	Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.	CVE-2020-11022 GHSA-gxr4-xjj5-5px2
VCID-cvxp-ctj9-guej	Potential XSS vulnerability in jQuery ### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.	CVE-2020-11023 GHSA-jpcq-cgw6-v4j6
VCID-ses2-y1j2-vbbx	Multiple vulnerabilities have been found in Cacti, the worst of which could result in the arbitrary execution of code.	CVE-2020-14295

Vulnerability

Summary

Aliases

VCID-16kp-5zpw-fbha

Insufficient output escaping of attachment names in PHPMailer ### Impact CWE-116: Incorrect output escaping. An attachment added like this (note the double quote within the attachment name, which is entirely valid): $mail->addAttachment('/tmp/attachment.tmp', 'filename.html";.jpg'); Will result in a message containing these headers: Content-Type: application/octet-stream; name="filename.html";.jpg" Content-Disposition: attachment; filename="filename.html";.jpg" The attachment will be named `filename.html`, and the trailing `";.jpg"` will be ignored. Mail filters that reject `.html` attachments but permit `.jpg` attachments may be fooled by this. Note that the MIME type itself is obtained automatically from the *source filename* (in this case `attachment.tmp`, which maps to a generic `application/octet-stream` type), and not the *name* given to the attachment (though these are the same if a separate name is not provided), though it can be set explicitly in other parameters to attachment methods. ### Patches Patched in PHPMailer 6.1.6 by escaping double quotes within the name using a backslash, as per RFC822 section 3.4.1, resulting in correctly escaped headers like this: Content-Type: application/octet-stream; name="filename.html\";.jpg" Content-Disposition: attachment; filename="filename.html\";.jpg" ### Workarounds Reject or filter names and filenames containing double quote (`"`) characters before passing them to attachment functions such as `addAttachment()`. ### References [CVE-2020-13625](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-13625). [PHPMailer 6.1.6 release](https://github.com/PHPMailer/PHPMailer/releases/tag/v6.1.6) ### For more information If you have any questions or comments about this advisory: * Open an issue in [the PHPMailer repo](https://github.com/PHPMailer/PHPMailer/issues)

CVE-2020-13625
GHSA-f7hx-fqxw-rvvj

VCID-5618-53yg-8qh4

Potential XSS vulnerability in jQuery ### Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround the issue without upgrading, adding the following to your code: ```js jQuery.htmlPrefilter = function( html ) { return html; }; ``` You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ https://jquery.com/upgrade-guide/3.5/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

CVE-2020-11022
GHSA-gxr4-xjj5-5px2

VCID-cvxp-ctj9-guej

Potential XSS vulnerability in jQuery ### Impact Passing HTML containing `<option>` elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code. ### Patches This problem is patched in jQuery 3.5.0. ### Workarounds To workaround this issue without upgrading, use [DOMPurify](https://github.com/cure53/DOMPurify) with its `SAFE_FOR_JQUERY` option to sanitize the HTML string before passing it to a jQuery method. ### References https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.

CVE-2020-11023
GHSA-jpcq-cgw6-v4j6

VCID-ses2-y1j2-vbbx

Multiple vulnerabilities have been found in Cacti, the worst of which could result in the arbitrary execution of code.

CVE-2020-14295

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-07T13:58:16.612281+00:00	Alpine Linux Importer	Fixing	VCID-5618-53yg-8qh4	https://secdb.alpinelinux.org/v3.22/community.json	38.1.0
2026-04-01T19:32:42.114941+00:00	Alpine Linux Importer	Fixing	VCID-ses2-y1j2-vbbx	https://secdb.alpinelinux.org/v3.22/community.json	38.0.0
2026-04-01T19:08:29.524267+00:00	Alpine Linux Importer	Fixing	VCID-16kp-5zpw-fbha	https://secdb.alpinelinux.org/v3.22/community.json	38.0.0
2026-04-01T19:04:37.339929+00:00	Alpine Linux Importer	Fixing	VCID-cvxp-ctj9-guej	https://secdb.alpinelinux.org/v3.22/community.json	38.0.0