Priority HIGH 76
graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.73957 · Published 2020-02-22 · No fix listed CWE-78
Priority MEDIUM 59
An issue was discovered in Open-AudIT 3.2.2.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.23901 · Published 2020-04-29 · No fix listed CWE-434
Priority MEDIUM 55
Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.40907 · Published 2018-07-25 · No fix listed CWE-79
Priority MEDIUM 50
An issue was discovered in Open-AudIT 3.3.1.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.09999 · Published 2020-04-28 · No fix listed CWE-78
Priority MEDIUM 46
An issue was discovered in Opmantek Open-AudIT after 3.5.0.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02073 · Published 2021-12-22 · No fix listed
Priority MEDIUM 45
An issue was discovered in Open-AudIT 3.2.2.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01237 · Published 2020-04-29 · No fix listed CWE-89
Priority MEDIUM 45
An issue was discovered in Open-AudIT 3.2.2.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04558 · Published 2020-04-27 · No fix listed CWE-78
Priority MEDIUM 41
The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01613 · Published 2019-09-13 · No fix listed CWE-78
Priority LOW 35
Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script.
CVSS 3.0HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.01187 · Published 2017-04-10 · No fix listed CWE-77
Priority LOW 34
Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03709 · Published 2021-12-20 · No fix listed CWE-79
Priority LOW 31
An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01081 · Published 2022-01-03 · No fix listed CWE-22
Priority LOW 29
Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS).
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00766 · Published 2021-02-05 · No fix listed CWE-79
Priority LOW 29
Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users using HTML 'password field' obfuscation.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01332 · Published 2021-01-20 · No fix listed
Priority LOW 29
Open-AudIT 3.3.0 allows an XSS attack after login.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.02587 · Published 2020-04-28 · No fix listed CWE-79
Priority LOW 28
Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribut…
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01867 · Published 2018-07-06 · No fix listed CWE-79
Priority LOW 28
Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Disc…
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01766 · Published 2018-05-10 · No fix listed CWE-79
Priority LOW 25
Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00653 · Published 2018-09-19 · No fix listed CWE-79
Priority LOW 25
Opmantek NMIS before 8.5.12G has XSS via SNMP.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00498 · Published 2017-04-10 · No fix listed CWE-79
THREATIST.IORead the docs