https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:13:37 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-05742 bdu:2024-05742 https://cve.radiocsirt.org/vuln/bdu:2024-05742 https://cve.radiocsirt.org/vuln/cleanstart-2024-uw33831 <p><strong>Affected:</strong> CleanStart: cacti</p> <p>Security vulnerability affects the cacti package. Cacti provides an operational monitoring and fault management framework.</p> <p><strong>Affected:</strong> CleanStart: cacti</p> <p>Security vulnerability affects the cacti package. Cacti provides an operational monitoring and fault management framework.</p> https://cve.radiocsirt.org/vuln/cleanstart-2024-uw33831 https://cve.radiocsirt.org/vuln/euvd-2026-258882 EUVD-2026-258882 https://cve.radiocsirt.org/vuln/euvd-2026-258882 https://cve.radiocsirt.org/vuln/fkie_cve-2024-25641 <p>Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the &#34;Package Import&#34; feature, allows authenticated users having the &#34;Import Templates&#34; permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.</p> <p>Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the &#34;Package Import&#34; feature, allows authenticated users having the &#34;Import Templates&#34; permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-25641 https://cve.radiocsirt.org/vuln/gsd-2024-25641 gsd-2024-25641 https://cve.radiocsirt.org/vuln/gsd-2024-25641 https://cve.radiocsirt.org/vuln/opensuse-su-2024:0274-1 <p>Security update for cacti, cacti-spine</p> <p>Security update for cacti, cacti-spine</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:0274-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-25641 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: cacti, Ubuntu:20.04:LTS: cacti, Ubuntu:22.04:LTS: cacti, Ubuntu:24.04:LTS: cacti</p> <p>Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the &#34;Package Import&#34; feature, allows authenticated users having the &#34;Import Templates&#34; permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: cacti, Ubuntu:20.04:LTS: cacti, Ubuntu:22.04:LTS: cacti, Ubuntu:24.04:LTS: cacti</p> <p>Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the &#34;Package Import&#34; feature, allows authenticated users having the &#34;Import Templates&#34; permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-25641 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1095 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cacti ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Code auszuführen oder und SQL-Injection oder Cross-Site-Scripting Angriffe durchzuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Cacti ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Code auszuführen oder und SQL-Injection oder Cross-Site-Scripting Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1095