PatchTheCVEthe cacti group vulnerabilities
Recent CVEs affecting the cacti group products. 15 tracked.
the cacti group has 15 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2007-06-07. Highest priority: CVE-2005-2149 (score 61/100).
- CVE-2007-3113 MEDIUM 6.8 UPGRADE Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a denial of service (CPU
- CVE-2007-3112 HIGH 7.8 UPGRADE graph_image.php in Cacti 0.8.6i, and possibly other versions, allows remote authenticated users to cause a den
- CVE-2006-6799 HIGH 7.5 UPGRADE SQL injection vulnerability in Cacti 0.8.6i and earlier, when register_argc_argv is enabled, allows remote att
- CVE-2006-0147 HIGH 7.5 DOWNGRADE DOWNGRADE Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in
- CVE-2006-0146 HIGH 7.5 DOWNGRADE DOWNGRADE The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2
- CVE-2005-2149 HIGH 10.0 DOWNGRADE config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify
- CVE-2005-2148 HIGH 7.5 DOWNGRADE Cacti 0.8.6e and earlier does not perform proper input validation to protect against common attacks, which all
- CVE-2005-1526 HIGH 7.5 UPGRADE PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e allows remote attackers
- CVE-2005-1525 HIGH 7.5 UPGRADE SQL injection vulnerability in config_settings.php for Cacti before 0.8.6e allows remote attackers to execute
- CVE-2005-1524 MEDIUM 5.0 UPGRADE PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly earlier versions allows
- CVE-2004-1737 HIGH 7.5 DOWNGRADE MITIGATE SQL injection vulnerability in auth_login.php in Cacti 0.8.5a allows remote attackers to execute arbitrary SQL
- CVE-2004-1736 MEDIUM 5.0 DOWNGRADE Cacti 0.8.5a allows remote attackers to gain sensitive information via an HTTP request to (1) auth.php, (2) au
- CVE-2002-1479 MEDIUM 4.6 DOWNGRADE Cacti before 0.6.8 stores a MySQL username and password in plaintext in config.php, which has world-readable p
- CVE-2002-1478 HIGH 10.0 DOWNGRADE Cacti before 0.6.8 allows attackers to execute arbitrary commands via the "Data Input" option in console mode.
- CVE-2002-1477 HIGH 7.5 DOWNGRADE graphs.php in Cacti before 0.6.8 allows remote authenticated Cacti administrators to execute arbitrary command
FAQ
How do I fix the cacti group vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is the cacti group being exploited right now?
None of the tracked the cacti group CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which the cacti group CVE should I patch first?
CVE-2005-2149 currently ranks highest (61/100): config.php in Cacti 0.8.6e and earlier allows remote attackers to set the no_http_headers switch, then modify .