📦

open-audit

Vendor: opmantek

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 11 Code Available
Total RCEs 5 Remote Access
Total CVEs 25 Total Indexed
Avg. EPSS 8.16% Exploit Prob.
Latest CVE CVE-2021-44674 Jan 03

Security Vulnerability Index

Page 2 / 3
8.8 CVSS
CVE-2020-8813
RCE Exploit Found

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.

EPSS: 73.78%
8.8 CVSS
CVE-2019-16293
RCE

The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field.

EPSS: 1.61%
5.4 CVSS
CVE-2018-16607

Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script via the Orgs name field.

EPSS: 0.65%
6.1 CVSS
CVE-2018-14493
Exploit Found

Cross-site scripting (XSS) vulnerability in the Groups Page in Open-Audit Community 2.2.6 allows remote attackers to inject arbitrary web script or HTML via the group name.

EPSS: 40.43%
5.4 CVSS
CVE-2018-11124
Exploit Found

Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute.

EPSS: 1.87%
5.4 CVSS
CVE-2018-10314
Exploit Found

Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover -> Audit Scripts -> List Scripts -> Download section.

EPSS: 1.87%
6.8 CVSS
CVE-2018-9137
Exploit Found

Open-AudIT before 2.2 has CSV Injection.

EPSS: 2.84%
5.4 CVSS
CVE-2018-9155
Exploit Found

Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the Admin->Logs section (with a logs?logs.type= URI) and the Manage->Attributes section (via the "Name (display)" field to the attributes/create URI).

EPSS: 1.18%
6.1 CVSS
CVE-2018-8937

An issue was discovered in Open-AudIT Professional 2.1. It is possible to inject a malicious payload in the redirect_url parameter to the /login URI to trigger an open redirect. A "data:text/html;base64," payload can be used with JavaScript code.

EPSS: 0.70%
8.8 CVSS
CVE-2018-8979
Exploit Found

Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.

EPSS: 1.31%