|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: cacti: multiple security issues fixed in 1.2.25 | ||
|---|---|---|---|
| Product: | [openSUSE] openSUSE Distribution | Reporter: | Andreas Stieger <Andreas.Stieger> |
| Component: | Security | Assignee: | Andreas Stieger <Andreas.Stieger> |
| Status: | RESOLVED MOVED | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | cathy.hu |
| Version: | Leap 15.5 | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Bug Depends on: | 1215039, 1215040, 1215042, 1215043, 1215044, 1215045, 1215047, 1215050, 1215051, 1215052, 1215053, 1215054, 1215055, 1215056, 1215058, 1215059, 1215081, 1215082 | ||
| Bug Blocks: | |||
|
Description
Andreas Stieger
2023-09-06 06:06:22 UTC
submitted CVE-2023-30534 CVE-2023-39360 CVE-2023-39361 CVE-2023-39357 CVE-2023-39362 CVE-2023-39359 CVE-2023-39358 CVE-2023-39365 CVE-2023-39364 CVE-2023-39366 CVE-2023-39510 CVE-2023-39512 CVE-2023-39513 CVE-2023-39514 CVE-2023-39515 CVE-2023-39516 This is an autogenerated message for OBS integration: This bug (1215024) was mentioned in https://build.opensuse.org/request/show/1109188 Factory / cacti https://build.opensuse.org/request/show/1109189 Backports:SLE-12+Backports:SLE-15-SP4+Backports:SLE-15-SP5 / cacti+cacti-spine Resolving in favor of individual bugs * CVE-2023-30534: Protect against Insecure deserialization of filter data (boo#1215082) * CVE-2023-39360: Cross-Site Scripting vulnerability when creating new graphs (boo#1215044) * CVE-2023-39361: Unauthenticated SQL Injection when viewing graphs (boo#1215045) * CVE-2023-39357: SQL Injection when saving data with sql_save() (boo#1215040) * CVE-2023-39362: Authenticated command injection when using SNMP options (boo#1215047) * CVE-2023-39359: Authenticated SQL injection vulnerability when managing graphs (boo#1215043) * CVE-2023-39358: Authenticated SQL injection vulnerability when managing reports (boo#1215042) * CVE-2023-39365: SQL Injection when using regular expressions (boo#1215051) * CVE-2023-39364: redirect in change password functionality (boo#1215050) * CVE-2023-39366: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215052) * CVE-2023-39510: Cross-Site Scripting vulnerability with Device Name when administrating Reports (boo#1215053) * CVE-2023-39511: Cross-Site Scripting vulnerability with Device Name when editing Graphs whilst managing Reports (boo#1215081) * CVE-2023-39512: Cross-Site Scripting vulnerability with Device Name when managing Data Sources (boo#1215054) * CVE-2023-39513: Cross-Site Scripting vulnerability with Device Name when debugging data queries (boo#1215055) * CVE-2023-39514: Cross-Site Scripting vulnerability with Data Source Name when managing Graphs (boo#1215056) * CVE-2023-39515: Cross-Site Scripting vulnerability with Data Source Name when debugging Data Queries (boo#1215058) * CVE-2023-39516: Cross-Site Scripting vulnerability with Data Source Information when managing Data Sources (boo#1215059) |