Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (4)
| Vulnerability |
Summary |
Aliases |
|
VCID-q88b-smmh-77ga
|
Cacti 1.1.27 allows remote authenticated administrators to conduct Remote Code Execution attacks by placing the Log Path under the web root, and then making a remote_agent.php request containing PHP code in a Client-ip header.
|
CVE-2017-16660
|
|
VCID-qbvv-frc2-rqbk
|
lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the path_rrdtool parameter in an action=save request to settings.php.
|
CVE-2017-16641
|
|
VCID-x1fg-6mq4-d7ds
|
Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files by placing the Log Path into a private directory, and then making a clog.php?filename= request, as demonstrated by filename=passwd (with a Log Path under /etc) to read /etc/passwd.
|
CVE-2017-16661
|
|
VCID-yjny-ubdp-7few
|
Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php.
|
CVE-2017-16785
|