SUSE Package Hub - openSUSE-2018-796

Update Info

openSUSE-2018-796

Optional package cacti

Type: optional

Severity: low

Issued: 2018-08-03

Description:

This update introduces cacti to PackageHub:
    Cacti is a complete front-end to RRDtool, capable of taking care of generating graphs, data gathering and so on.

References

CVE: CVE-2017-16785
CVE: CVE-2017-16661
CVE: CVE-2017-16660
CVE: CVE-2017-16641
CVE: CVE-2017-15194
CVE: CVE-2017-12978
CVE: CVE-2017-12927
CVE: CVE-2017-12065
CVE: CVE-2017-11691
CVE: CVE-2017-11163
CVE: CVE-2017-10970
CVE: CVE-2016-3659
CVE: CVE-2016-3172
CVE: CVE-2016-2313
CVE: CVE-2015-8604
CVE: CVE-2015-8377
CVE: CVE-2015-8369
CVE: CVE-2015-4634
CVE: CVE-2015-4342
CVE: CVE-2014-5026
CVE: CVE-2014-5025
CVE: CVE-2014-4002
CVE: CVE-2014-4000
CVE: CVE-2014-2709
CVE: CVE-2014-2708
CVE: CVE-2014-2328
CVE: CVE-2014-2327
CVE: CVE-2014-2326
CVE: CVE-2013-5589
CVE: CVE-2013-5588
CVE: CVE-2007-3113
CVE: CVE-2007-3112
CVE: CVE-2006-6799
Bugzilla: 974013 VUL-0: CVE-2016-3659: cacti: graph_view.php SQL Injection Vulnerability
Bugzilla: 971357 VUL-0: CVE-2016-3172: cacti: SQL Injection Vulnerability
Bugzilla: 965930 VUL-0: CVE-2016-2313: cacti: Authentication using web authentication as a user not in the cacti database allows complete access
Bugzilla: 960678 VUL-0: CVE-2015-8604: cacti: SQL injection vulnerability in graphs_new.php
Bugzilla: 958977 VUL-0: CVE-2015-8377: cacti: SQL injection in graphs_new.php
Bugzilla: 958863 VUL-0: CVE-2015-8369: cacti: SQL injection in graph.php
Bugzilla: 937997 VUL-0: CVE-2015-4634: cacti: multiple SQL injection flaws fixed in 0.8.8e
Bugzilla: 934187 VUL-0: CVE-2015-4342: cacti: Multiple XSS and SQL injection vulnerabilities
Bugzilla: 872008 VUL-0: CVE-2014-2708, CVE-2014-2709: cacti: command injection issues
Bugzilla: 870821 VUL-0: CVE-2014-2326: cacti: xss attacjs ub 0.8.7g
Bugzilla: 867607 server:monitoring/cacti: Bug require apache2-mod_php5
Bugzilla: 862993 server:monitoring/cacti: Bug
Bugzilla: 837440 VUL-0: CVE-2013-5588 CVE-2013-5589: cacti: XSS and SQL injection vulnerabilities
Bugzilla: 1101139 cacti.conf Apache Invalid command 'Order'
Bugzilla: 1101024 missing php packages in cacti.spec
Bugzilla: 1068028 VUL-0: CVE-2017-16785: Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php.
Bugzilla: 1067166 VUL-0: CVE-2017-16641: cacti: lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands
Bugzilla: 1067164 VUL-0: CVE-2017-16660: cacti: Cacti 1.1.27 allows remote authenticated administrators to conduct Remote CodeExecution attacks
Bugzilla: 1067163 VUL-0: CVE-2017-16661: cacti: Cacti 1.1.27 allows remote authenticated administrators to read arbitrary files
Bugzilla: 1054742 VUL-0: CVE-2017-12978: cacti: lib/html.php in Cacti before 1.1.18 has XSS via the title field of anexternal link added by an authenticated user.
Bugzilla: 1054390 VUL-0: CVE-2017-12927: cacti: XSS in methodparameter in spikekill.php.
Bugzilla: 1051633 VUL-0: CVE-2017-12065: cacti: Possible code execution via avgnan, outlier-start, or outlier-end parameter
Bugzilla: 1050950 VUL-0: CVE-2017-11691: cacti: XSS in auth_profile.php allows remote attackers to inject arbitrary JS via specially crafted HTTP Referer headers
Bugzilla: 1048102 VUL-0: CVE-2017-11163: cacti: Cross-site scripting (XSS) vulnerability in aggregate_graphs.php allows remote authenticated users to inject arbitrary web script or HTML
Bugzilla: 1047512 VUL-0: CVE-2017-10970: cacti: Cross-site scripting (XSS) vulnerability in link.php in Cacti 1.1.12allows remote anonymous users to inject arbitrary web script or HTMLvia the id parameter, related to the die_html_input_error function inlib/html_
Bugzilla: 022564 https://bugzilla.opensuse.org/show_bug.cgi?id=022564

Packages

cacti-1.1.38-2.1