CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2021-3333 |
| 보통6.1 |
Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link. |
| 05/02/2021 |
| CVE-2021-3130 | 보통5.9 | Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible. | 20/01/2021 |
| CVE-2020-11943 | 높음8.8 | An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload. | 29/04/2020 |
| CVE-2020-11942 | 심각9.8 | An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections. | 29/04/2020 |
| CVE-2020-12261 | 보통5.4 | Open-AudIT 3.3.0 allows an XSS attack after login. | 28/04/2020 |
| CVE-2020-12078 | 높음8.8 | An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings (internally called exclude_ip). This exclude_ip value is passed to the exec function in t | 28/04/2020 |
| CVE-2020-11941 | 높음8.8 | An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery. | 27/04/2020 |
| CVE-2020-8813 | 높음8.8 | graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege. | 22/02/2020 |
| CVE-2019-16293 | 높음8.8 | The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field. | 13/09/2019 |
| CVE-2018-16607 | 보통5.4 | Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field. | 19/09/2018 |
| CVE-2018-14493 | 보통6.1 | Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name. | 25/07/2018 |
| CVE-2018-11124 | 보통5.4 | Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute. | 06/07/2018 |
| CVE-2018-10314 | 보통5.4 | Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover -> Audit Scripts -> List Scripts -> Download section. | 10/05/2018 |
| CVE-2016-6534 | 높음7.5 | Opmantek NMIS before 4.3.7c has command injection via man, finger, ping, trace, and nslookup in the tools.pl CGI script. Versions before 8.5.12G might be affected in non-default configurations. | 10/04/2017 |
| CVE-2016-5642 | 보통5.4 | Opmantek NMIS before 8.5.12G has XSS via SNMP. | 10/04/2017 |