open-audit vulnerabilities and fixes

Recent CVEs affecting open-audit, with upgrade or downgrade steps. 22 tracked.

Also searched as: open audit.

open-audit has 22 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2022-01-03. Highest priority: CVE-2020-8813 (score 66/100).

• CVE-2021-44674 MEDIUM 6.5 DOWNGRADE An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0
• CVE-2021-44916 MEDIUM 6.1 UPGRADE Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability
• CVE-2021-40612 CRITICAL 9.8 UPGRADE An issue was discovered in Opmantek Open-AudIT after 3.5.0
• CVE-2021-3333 MEDIUM 6.1 DOWNGRADE Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS)
• CVE-2021-3130 MEDIUM 5.9 UPGRADE Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords,
• CVE-2020-8813 HIGH 8.8 DOWNGRADE MITIGATE graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metachara
• CVE-2020-12261 MEDIUM 5.4 DOWNGRADE Open-AudIT 3.3.0 allows an XSS attack after login.
• CVE-2020-12078 HIGH 8.8 DOWNGRADE An issue was discovered in Open-AudIT 3.3.1
• CVE-2020-11943 HIGH 8.8 DOWNGRADE An issue was discovered in Open-AudIT 3.2.2
• CVE-2020-11942 CRITICAL 9.8 DOWNGRADE An issue was discovered in Open-AudIT 3.2.2
• CVE-2020-11941 HIGH 8.8 DOWNGRADE An issue was discovered in Open-AudIT 3.2.2
• CVE-2019-16293 HIGH 8.8 UPGRADE The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrar
• CVE-2018-9155 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject ar
• CVE-2018-9137 MEDIUM 6.8 UPGRADE Open-AudIT before 2.2 has CSV Injection.
• CVE-2018-8979 HIGH 8.8 DOWNGRADE Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences v
• CVE-2018-8978 MEDIUM 5.4 DOWNGRADE Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.
• CVE-2018-8937 MEDIUM 6.1 DOWNGRADE An issue was discovered in Open-AudIT Professional 2.1
• CVE-2018-8903 MEDIUM 5.4 DOWNGRADE Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.
• CVE-2018-16607 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows r
• CVE-2018-14493 MEDIUM 6.1 DOWNGRADE Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attack
• CVE-2018-11124 MEDIUM 5.4 UPGRADE Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.
• CVE-2018-10314 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbit

FAQ

How do I fix open-audit vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is open-audit being exploited right now?

None of the tracked open-audit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which open-audit CVE should I patch first?

CVE-2020-8813 currently ranks highest (66/100): graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metachara.

RSS feed for open-audit · ← Back to latest CVEs