CVE-2014-5026

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.cacti.net/view.php?id=2456Issue Tracking, Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q3/244Exploit, Third Party Advisory, VDB Entry
http://www.debian.org/security/2014/dsa-3007Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/22/9Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68759Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/94816
https://security.gentoo.org/glsa/201509-03
http://bugs.cacti.net/view.php?id=2456Issue Tracking, Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q3/244Exploit, Third Party Advisory, VDB Entry
http://www.debian.org/security/2014/dsa-3007Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/22/9Exploit, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/68759Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/94816
https://security.gentoo.org/glsa/201509-03

Timeline

Published: Oct 20, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-50274.3Cross-site scripting (XSS) vulnerability in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allows remote attackers to inject arbitr CVE-2014-50286.5The Original File and Patched File resources in Review Board 1.7.x before 1.7.27 and 2.0.x before 2.0.4 allow remote authenticated users to CVE-2014-50291.5The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups CVE-2014-50301.9CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.CVE-2014-50315.0The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sen CVE-2014-50325.0GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via CVE-2014-50336.9KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users CVE-2014-50348.8Cross-site request forgery (CSRF) vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hija CVE-2014-50356.8The Netconf (TCP) service in OpenDaylight 1.0 allows remote attackers to read arbitrary files via an XML external entity declaration in conj CVE-2014-50361.9The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user c CVE-2014-50372.1Eucalyptus 4.0.0 through 4.0.1, when the log level is set to INFO, logs user and system passwords, which allows local users to obtain sensit CVE-2014-50382.1Eucalyptus 3.0.0 through 4.0.1, when the log level is set to DEBUG or lower, logs user and system passwords, which allows local users to obt