Поиск уязвимостей
Количество 7
Количество 7
BDU:2023-05455
Уязвимость функции host_new_graphs_save() (graphs_new.php) программного средства мониторинга сети Cacti, позволяющая нарушителю выполнить произвольный код
CVE-2023-30534
Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-30534
Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-30534
Cacti is an open source operational monitoring and fault management fr ...
ALT-PU-2023-7621
ALT-PU-2023-7621: package `cacti` update to version 1.2.25-alt1
ALT-PU-2023-7619
ALT-PU-2023-7619: package `cacti` update to version 1.2.25-alt1
openSUSE-SU-2023:0275-1
Security update for cacti, cacti-spine
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2023-05455 Уязвимость функции host_new_graphs_save() (graphs_new.php) программного средства мониторинга сети Cacti, позволяющая нарушителю выполнить произвольный код | CVSS3: 4.3 | 3% Низкий | около 3 лет назад |
 | CVE-2023-30534 Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. | CVSS3: 4.3 | 3% Низкий | около 3 лет назад |
 | CVE-2023-30534 Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory (phpseclib), the necessary gadgets are not included, making them inaccessible and the insecure deserializations not exploitable. Each instance of insecure deserialization is due to using the unserialize function without sanitizing the user input. Cacti has a “safe” deserialization that attempts to sanitize the content and check for specific values before calling unserialize, but it isn’t used in these instances. The vulnerable code lies in graphs_new.php, specifically within the host_new_graphs_save function. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. | CVSS3: 4.3 | 3% Низкий | около 3 лет назад |
| CVE-2023-30534 Cacti is an open source operational monitoring and fault management fr ... | CVSS3: 4.3 | 3% Низкий | около 3 лет назад |
| ALT-PU-2023-7621 ALT-PU-2023-7621: package `cacti` update to version 1.2.25-alt1 | CVSS3: 9.8 | почти 3 года назад | |
| ALT-PU-2023-7619 ALT-PU-2023-7619: package `cacti` update to version 1.2.25-alt1 | CVSS3: 9.8 | почти 3 года назад | |
 | openSUSE-SU-2023:0275-1 Security update for cacti, cacti-spine | около 3 лет назад |
Уязвимостей на страницу