cacti-user Mailing List for Cacti (Page 8)

*** Release of Cacti 1.1.3 ***

Special thanks to all that have helped by contributing code and 
reporting issues on GitHub! We would not be where we are today without 
the help. Let's continue to grow the Cacti community!

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti Change Log ***
     issue#515: Unable to import color CSV file
     issue#519: In non-classic themes its not possible to remove Cacti
                log or reporting tabs
     issue#520: SQL error in graph automation
     issue#521: Cacti allows removal of Data Query Graph Template
                associations when they are in use
     issue#525: LAST GPRINT type not rendered correctly due to lack of
                escaping
     issue#530: Undefined function get_vdef in lib/rrd.php
     issue#531: Issues with TextAlign and Tick graph items
     issue#532: Unreliable scroll height causes issues in Chrome
     issue#533: User settings not cleared after saving profile
     issue#534: Automation issue with AS clause
     issue#538: Unable to rename tree folder
     issue#541: Issues with mobile graph viewing
     issue#555: DSStats SQL insert errors due to data collection issues
     issue#563: Division by zero in removespikes.php
     issue: Fixed rendering issues with HRULE's on graphs
     issue: Update jsTree to 3.3.4 version
     feature: Improved responsiveness UI tables, filters, and menus

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group

I’ve noticed this prior but never opened the console.  Chrome on Mac and FF on Mac don’t have this problem IF you don’t run it out to the right margin.

Basically, if the cursor goes from crosshair to vertical beam, it doesn’t do anything.  If you approach the side of the graph and keep it as an arrow (not cross over the graph edge) it works.

Is that the case for you?

EKG

> On Apr 12, 2017, at 11:21 AM, Laurence Robinson <LRo...@si...> wrote:
> 
> Dear All,
> 
> Cacti version 1.1.2 (and indeed 1.1.1) has an issue regarding the zooming in onto graphs on the standard graph tree view. When attempting to zoom in on a particular graph, using either crosshair dragging or right-clicking and selecting 'Zoom In,' the selected area fails to zoom in or nothing happens, respectively.
> 
> When examining the developer console in Chrome, the following error has always been generated after attempting a zoom:
> 
> 
> jquery.js:273 Uncaught Error: cannot call methods on selectmenu prior to initialization; attempted to call method 'refresh' at Function.error (http://cacti.local/include/js/jquery.js:273:9) at HTMLSelectElement.<anonymous> (http://cacti.local/include/js/jquery-ui.js:6:9075) at Function.each (http://cacti.local/include/js/jquery.js:368:19) at jQuery.fn.init.each (http://cacti.local/include/js/jquery.js:157:17) at jQuery.fn.init.e.fn.(anonymous function) [as selectmenu] (http://cacti.local/include/js/jquery-ui.js:6:8817) at setCustomFilterActionActionAndDate (http://cacti.local/include/js/jquery.zoom.js:698:40) at zoomAction_zoom_in (http://cacti.local/include/js/jquery.zoom.js:638:4) at HTMLDivElement.<anonymous> (http://cacti.local/include/js/jquery.zoom.js:434:9) at HTMLDivElement.dispatch (http://cacti.local/include/js/jquery.js:5110:27) at HTMLDivElement.elemData.handle (http://cacti.local/include/js/jquery.js:4918:28)
> 
> If you click on the 'Graph Details, Zooming and Debugging Utilities' icon next to any particular graph, and then attempt a zoom, it works perfectly.
> 
> Two other users on the Cacti forum and I have reported this issue now. I am running CentOS 7.2. The issue affects Chrome, Firefox and Edge.
> 
> Any thoughts, before I file this with the Cacti devs as a bug, are appreciated.
> 
> Regards,
> 
> Laurence
> 
> [https://www.sire.co.uk/assets/page/21years.png]        [https://www.sire.co.uk/assets/page/Sire_logo.png] <https://www.sire.co.uk>
> 
> SIRE Technology Ltd
> 16 Wellington Business Park | Crowthorne
> Berkshire | RG45 6LS
> Tel +44 (0)1344 758700
> // Cloud Solutions // Business Continuity // Managed Service Provider
> [https://www.sire.co.uk/assets/page/GooglePlus_logo.png]<https://plus.google.com/116233647316214883051> [https://www.sire.co.uk/assets/page/LinkedIn_logo.png] <http://www.linkedin.com/company/2352727>        [https://www.sire.co.uk/assets/page/Twitter_logo.png] <http://twitter.com/SIRETechnology>
> 
> 
> [https://www.sire.co.uk/assets/page/bci.jpg] <https://www.sire.co.uk/about/news/detail/sire-technology-joins-the-business-continuity-institute-bci>
> 
> 
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> cacti-user mailing list
> cac...@li...
> https://lists.sourceforge.net/lists/listinfo/cacti-user

Dear All,

Cacti version 1.1.2 (and indeed 1.1.1) has an issue regarding the zooming in onto graphs on the standard graph tree view. When attempting to zoom in on a particular graph, using either crosshair dragging or right-clicking and selecting 'Zoom In,' the selected area fails to zoom in or nothing happens, respectively.

When examining the developer console in Chrome, the following error has always been generated after attempting a zoom:


jquery.js:273 Uncaught Error: cannot call methods on selectmenu prior to initialization; attempted to call method 'refresh' at Function.error (http://cacti.local/include/js/jquery.js:273:9) at HTMLSelectElement.<anonymous> (http://cacti.local/include/js/jquery-ui.js:6:9075) at Function.each (http://cacti.local/include/js/jquery.js:368:19) at jQuery.fn.init.each (http://cacti.local/include/js/jquery.js:157:17) at jQuery.fn.init.e.fn.(anonymous function) [as selectmenu] (http://cacti.local/include/js/jquery-ui.js:6:8817) at setCustomFilterActionActionAndDate (http://cacti.local/include/js/jquery.zoom.js:698:40) at zoomAction_zoom_in (http://cacti.local/include/js/jquery.zoom.js:638:4) at HTMLDivElement.<anonymous> (http://cacti.local/include/js/jquery.zoom.js:434:9) at HTMLDivElement.dispatch (http://cacti.local/include/js/jquery.js:5110:27) at HTMLDivElement.elemData.handle (http://cacti.local/include/js/jquery.js:4918:28)

If you click on the 'Graph Details, Zooming and Debugging Utilities' icon next to any particular graph, and then attempt a zoom, it works perfectly.

Two other users on the Cacti forum and I have reported this issue now. I am running CentOS 7.2. The issue affects Chrome, Firefox and Edge.

Any thoughts, before I file this with the Cacti devs as a bug, are appreciated.

Regards,

Laurence

[https://www.sire.co.uk/assets/page/21years.png]        [https://www.sire.co.uk/assets/page/Sire_logo.png] <https://www.sire.co.uk>

SIRE Technology Ltd
16 Wellington Business Park | Crowthorne
Berkshire | RG45 6LS
Tel +44 (0)1344 758700
// Cloud Solutions // Business Continuity // Managed Service Provider
[https://www.sire.co.uk/assets/page/GooglePlus_logo.png]<https://plus.google.com/116233647316214883051> [https://www.sire.co.uk/assets/page/LinkedIn_logo.png] <http://www.linkedin.com/company/2352727>        [https://www.sire.co.uk/assets/page/Twitter_logo.png] <http://twitter.com/SIRETechnology>


[https://www.sire.co.uk/assets/page/bci.jpg] <https://www.sire.co.uk/about/news/detail/sire-technology-joins-the-business-continuity-institute-bci>

*** Release of Cacti 1.1.2 ***

Special thanks to all that have helped by contributing code and 
reporting issues on GitHub! We would not be where we are today without 
the help. Let's continue to grow the Cacti community!

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti Change Log ***
   issue#492: Error while adding non data query (cg) graphs
   issue#494: CLI error while importing template
   issue#499: SQL error in graph automation resulting in no graphs on
              tree
   issue#500: Generic SNMP device package damaged - Unix Ping Host
   issue#505: Log rotation does not work in some cases
   issue#506: Undefined index: cactiStatsDeviceFailedPolls
   issue#507: Nextwork discovery 'export' produces no results
   issue#509: Minor bug with device ownership selection
   feature: Add new legend type that includes Current/Average/
            Minimum/Maximum
   feature: Update d3.js to latest version 4.7.4

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group

*** Release of Cacti 1.1.1 ***

Special thanks to all that have helped by contributing code and 
reporting issues on GitHub! We would not be where we are today without 
the help. Let's continue to grow the Cacti community!

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti Change Log ***
   issue#457: Continued LDAP issues with initial user creation
   issue#461: The function escapeshell arg not appropriate on Windows
   issue#462: LDAP authorization issues: group membership check broken
              for 'Group Member Type' = 'Username'
   issue#464: Change default batch spike removal limits for standard
              deviation and variance
   issue#465: Less than sign inside items and labels of graph break graph
   issue#466: Call to member function row() on a non-object in
              lib/snmpagent.php
   issue#467: Reduce the number of queries in log function
   issue#472: Schema changes to improve performance
   issue#485: When editing a device, the ping status was not always
              returned
   issue: Back button issues due to syntax problems in JavaScript
   issue: Zoom periodically would loose it's crosshairs after zooming
   issue: Zoom would zoom out into the future even when disabled
   issue: Fixing lite corruption in graph_templates_item table
   feature: Make SpikeKill options more consistent
   feature#459: Add variable date time option to report mail subject
   feature#460: Add external_id to host variables
   feature#469: Change re-index method of Data Query from Device edit
   feature: Support generalized date format approach in the GUI
   feature: Use localStorage over a Cookie for Zoom setting storage
   feature: Fully implement 'Remove Orphans' from Package import process

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group

Hi, 

i wrote plugins for Cacti 0.8.8.h, and it works fine. I've found the new version of Cacit pretty and simple, and i try to import my old plugins, like netMet, mactracks, Znets, GPSMap, Weathermap, 
and so one, by doing a recopy beetween my old server to the new one. 

But inside the menu "plugins", all of them are shown "incompatible". Is there a way to bypass, or all the plugins need to be rewritten ? 

Sincerly, 

Emmanuel 

------------------------------------------ 

Emmanuel REUTER 
IFSTTAR - Systèmes d'Informations et Ressources Informatiques 
Site de Bron 
Cité des mobilités 
25 avenue François Mitterrand 
69675 Bron Cedex 
Tél. : (+33) 04.72.14.25.54 
------------------------------------------ 
"Personne n'est devenu fort en montrant comment une autre personne est faible". (Nelson Mandela) 

*** Release of Cacti 1.1.0 ***

Special thanks to all that have helped by contributing code and 
reporting issues on GitHub! We would not be where we are today without 
the help. Let's continue to grow the Cacti community!

We do consider this to be the most stable 1.0.0 release yet! If you 
encounter any issues please visit the forums or submit an issue on GitHub.

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti Change Log ***
   issue#337: Generic SNMP OID Graph Template damanged
   issue#338: Extremely slow new graph/DS creation
   issue#353: Broadcast & Multicast Packet counters missing
   issue#376: Structured RRD path permission issues
   issue#389: Manual template based graph creation not working
   issue#407: The RRDfile does not exist message is misleading
   issue#410: Select character data was interpreted as hex by
             cacti_snmp_walk()
   issue#422: additional issues with LDAP authentication
   issue#424: Automation does not discover devices w/o resolvable
              hostnames
   issue#427: undefined index TotalVisibleMemorySize on FreeBSD
   issue#432: SpikeKill menu wonky on Paw Theme
   issue#434: password_verify not compatible in php5.4-
   issue#435: urlPath missing from paw theme links
   issue#436: Restricted user does not see graphs in tree view
   issue#443: Allow remote_agent.php through a NAT
   issue#446: No local admin when using multiple LDAP configuration
   issue#447: Creating another non data query graph from same template
              reuses first data source
   issue#449: exec_poll_php does not flush pipes when using script server
   issue#450: Graph list view - No Graphs Found
   issue: Improve email test exception errors and change default timeout
          to 10 seconds
   issue: When on links page, breadcrumbs would become corrupted
   issue: When upgrading from any version of Cacti to 1.0.5, SQL's
          relative to poller_reindex might appear
   issue: Color page performance poor
   issue: The Device dropdown on the Graph View page was unreliable
   issue: Aggregate and non-Device Graphs in list view had not Device or
          Title description
   issue: Re-engineer back button design to accomocate ajax and native
          navigation
   issue: Make Graph Template filter wider
   issue: Resolve some visual issues in Classic theme
   feature: Add page refresh API to make page refreshing in Ajax easier
            to accomplish
   feature: Update fontawesome to version 4.7
   feature: Use fontawesome glyphs for menu items
   feature: Support multiple column sort in table library
   feature: Add glyphs to main Cacti console menu

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group

Hello,

 

            I have to present a vulnerability : CVE-2016-3172 (SQL Injection
/ tree.php) + CVE-2015-8604 (SQL Injection / graphs_new.php) in a university
defense

I installed cacti 0.8.8f on a virtual machine and i would replay the sql
injection. 
Unfortunately I can not. 
Could you help me ? How to replay this injection? 

 

Thanks for your help

 

De : David Liedke [mailto:li...@rz...] 
Envoyé : mercredi 15 mars 2017 08:10
À : STRABACH Jérôme DTSI/DERS
Objet : Re: Info CVE-2016-3172 (SQL Injection / tree.php) + CVE-2015-8604
(SQL Injection / graphs_new.php)

 

Hello,

Sorry - i dont know. I am only one of the package maintainers of the cacti
package in the openSUSE Repository.
Maybe you can ask on the "cacti-user" mailing list -->
http://cacti.net/mailing_lists.php

Good luck.

Regards,
David 

Am 14.03.2017 um 19:01 schrieb jer...@or...:

Hello,

I am a student at the University of Lille, in France
I begin my studies in network security.
I have to present a vulnerability : CVE-2016-3172 (SQL Injection / tree.php)
+ CVE-2015-8604 (SQL Injection / graphs_new.php)

For CVE-2015-8604 :
http://www.cvedetails.com/cve-details.php?t=1
<http://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2015-8604>
&cve_id=CVE-2015-8604
http://www.openwall.com/lists/oss-security/2016/03/10/13

CVE-2016-3172
https://www.cvedetails.com/cve-details.php?t=1
<https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2016-3172>
&cve_id=CVE-2016-3172

I installed cacti 0.8.8f on a virtual machine and i would replay the sql
injection. 
Unfortunately I can not. 
Could you help me ? How to replay this injection? 

Thanks for your help

*** Release of Cacti 1.0.6 ***

We the Cacti Group are proud to release the following:

     Cacti 1.0.6
     Spine 1.0.6

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti Change Log ***
   issue#386: Allow special characters in graph title
   issue#414: Install Wizard check path for spine
   issue#415: SNMP session handling broken
   issue#418: LDAP create user from template not working

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group

Fixed it.  Many thanks

EKG

> On Mar 14, 2017, at 10:28 AM, David Liedke <li...@rz...> wrote:
> 
> https://github.com/Cacti/cacti/issues/415
> 
> Am 14.03.2017 um 15:04 schrieb Eric Germann:
>> I just upgraded from 1.04 to 1.05. Nothing else changed. I now receive
>> 
>> 	PCOMMAND Device[264] WARNING: Recache Event Detected for Device for every single host polled via ucd/net snmp.
>> 
>> Any ideas where to look?
>> 
>> Running poller.php returns values just fine.
>> 
>> Setting to debug level yields hundreds of.
>> 
>> 2017-03-14 06:40:00 - POLLER: Poller[1] ASSERT: '2=U' failed. Recaching host '172.28.10.12', data query #1
>> 2017-03-14 06:40:00 - POLLER: Poller[1] ASSERT: '2=U' failed. Recaching host '172.28.10.12', data query #2
>> 
>> The number before the = may vary, but same messages.
>> 
>> Graphs have no data since now.
>> 
>> Trying to figure out how to roll back
> 
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot_______________________________________________
> cacti-user mailing list
> cac...@li...
> https://lists.sourceforge.net/lists/listinfo/cacti-user

https://github.com/Cacti/cacti/issues/415

Am 14.03.2017 um 15:04 schrieb Eric Germann:
> I just upgraded from 1.04 to 1.05. Nothing else changed. I now receive
>
> 	PCOMMAND Device[264] WARNING: Recache Event Detected for Device for every single host polled via ucd/net snmp.
>
> Any ideas where to look?
>
> Running poller.php returns values just fine.
>
> Setting to debug level yields hundreds of.
>
> 2017-03-14 06:40:00 - POLLER: Poller[1] ASSERT: '2=U' failed. Recaching host '172.28.10.12', data query #1
> 2017-03-14 06:40:00 - POLLER: Poller[1] ASSERT: '2=U' failed. Recaching host '172.28.10.12', data query #2
>
> The number before the = may vary, but same messages.
>
> Graphs have no data since now.
>
> Trying to figure out how to roll back

I just upgraded from 1.04 to 1.05. Nothing else changed. I now receive

	PCOMMAND Device[264] WARNING: Recache Event Detected for Device for every single host polled via ucd/net snmp.

Any ideas where to look?

Running poller.php returns values just fine.

Setting to debug level yields hundreds of.

2017-03-14 06:40:00 - POLLER: Poller[1] ASSERT: '2=U' failed. Recaching host '172.28.10.12', data query #1
2017-03-14 06:40:00 - POLLER: Poller[1] ASSERT: '2=U' failed. Recaching host '172.28.10.12', data query #2

The number before the = may vary, but same messages.

Graphs have no data since now.

Trying to figure out how to roll back

T'es pas très curieux pour quelqu'un qui fait de la sécurité.Tu demandes les réponses sans être allé au bout des choses, certes tu as un peu cherché et bien formulé ton mail mais c'est vraiment pas assez...vraiment pas.

Trouve le code avant correctif et après correctif, fais un diff. Tu observeras ce qui a été corrigé et ça sera un bon début pour trouver comment reproduire l'exploit.

Et prépare toi à recevoir du spam puisque tu as écris avec ta boite pro =)) 

    Le Mercredi 8 mars 2017 11h38, "jer...@or..." <jer...@or...> a écrit :
 

 Hello,

I am a student at the University of Lille, in France
I begin my studies in network security.
I have to present a vulnerability : CVE-2016-3172 (SQL Injection / tree.php) + CVE-2015-8604 (SQL Injection / graphs_new.php)

For CVE-2015-8604 :
http://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2015-8604
http://www.openwall.com/lists/oss-security/2016/03/10/13

Can you explain this vulnerability :
- how to reproduce it ?
- how to correct it?
"The parameter parent_id is used without any validation."

- Can you explain what the "parent_id" is, what is its function?

- What is the impact ? An example ?



I don't have access to cacti bug tracker :

- Can you give me a copy of the cacti bug tracker :

- Can you tell me, how this CVE was corrected ? The simple principle ?



the same thing for CVE-2016-3172

https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2016-3172

thank you

Cordialement

[Logo Orange]<http://www.orange.com/>
 Jérôme Strabach
Analyste Qualité de fonctionnement du Réseaux Cœur Voix
ORANGE/OF/DTSI/DERS/DR/DRM/VMI/CCI ET PERF
Lyon Sévigné
Mobile : +33 6 71 54 75 23 <https://monsi.sso.francetelecom.fr/index.asp?target=http%3A%2F%2Fclicvoice.sso.francetelecom.fr%2FClicvoiceV2%2FToolBar.do%3Faction%3Ddefault%26rootservice%3DSIGNATURE%26to%3D+33%206%2071%2054%2075%2023>
jer...@or...<mailto:jer...@or...>

[cid:image002.png@01D297FD.49A313F0]


_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

------------------------------------------------------------------------------
Announcing the Oxford Dictionaries API! The API offers world-renowned
dictionary content that is easy and intuitive to access. Sign up for an
account today to start using our lexical data to power your apps and
projects. Get started today and enter our developer competition.
http://sdm.link/oxford
_______________________________________________
cacti-user mailing list
cac...@li...
https://lists.sourceforge.net/lists/listinfo/cacti-user


   

*** Release of Cacti 1.0.5 ***

We the Cacti Group are proud to release the following:

     Cacti 1.0.5
     Spine 1.0.5

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti Change Log ***
   issue#296: Poller warning for Non-SNMP device
   issue#319: Add default 'High Collection Rate' data source profile
              to new installs to demonstrate concept of multiple rates
   issue#330: Import templates to non-default Data Profile
   issue#337: Error when try create new graph - SNMP - Generic OID
   issue#342: Infinite loop in poller_automation.php with invalid
              schedule
   issue#343: Device discovery cannot handle dots in device name
   issue#344: Unable to upgrade to latest Cacti on FreeBSD
   issue#353: Legacy broadcast & multicast packet counters missing in
              interface.xml
   issue#354: Place on tree dashes / ordering is not correct
   issue#355: Replace table rows with count when using InnoDB tables
   issue#357: If recovery mode runs longer than a polling interval, a
              second is spawned
   issue#358: Sending test e-mail results in warning
   issue#360: Issue importing cacti.sql with some charsets
   issue#364: Moving graph item causes page render issue
   issue#365: ss_host_disk.php and ss_host_cpu.php should use return
   issue#367: Upgrade chart.js to version 2.5
   issue#368: Issue with device automation ip vs. ip_address
   issue#369: Interface bits/second total Bandwidth wrong CDEF
   issue#375: Drag and Drop of Devices and Graphs allows dropping
              onto self
   issue#380: Ignores a non-standard SNMP port
   issue#382: When using php5.5+ new users unable to change their
              password
   issue#384: graph_view.php backtrace errors
   issue#385: Unable to place an aggregate grapn on a subtree
   issue#390: Display graphs from this aggregate icon next to graph not
              displaying
   issue#392: cdef.php missing sql where for system cdef's
   issue#398: checkbox is not honored when creating tree
   issue#399: External link configuration: Order buttons don't work
   issue#400: SNMP Engine ID (v3) field too short
   issue#401: Graphs -> Apply Automation Rules fails
   issue#404: Success even when test mail fails
   issue#406: HRULE text format special characters not escaped
   issue#408: Suppress SNMP units suffix from cacti_snmp_get() output
   issue: Improve is_ipaddress functions
   issue: Drag & drop showing when disabled on page
          automation_templates.php
   issue: Output messages displayed incorrectly in
          automation_templates.php and automation_snmp.php
   issue: Importing template from old Cacti would not show data templates
   issue: Handle snmp error exceptions better
   issue: Update Apache .htaccess files to support multiple version
   issue: When executing a full sync, if the table structured has
          changed, recreate the remote table
   issue: Multiple domains not working as expected
   feature#197: Add external_id to Cacti for linking Cacti to other
                monitoring systems
   feature#332: Support copy user groups
   feature: Log proper IP address if logging in behind a NAT
   feature: New qquery parsing rules: VALUE/TEST, VALUE/TABLE,
            VALUE/HEX2IP

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group

> Hi,
>
> I did an upgrade from 0.8.8g to 1.0.4 and it went quite well, I can login
> to the web interface, graphs are updating, but I can't make any changes
> through the web interface.
>
> For example if I go to Settings, and try to change the path for the cacti
> log, hit "Save" and the page reloads with the old path still showing.
>
> Same happens if I try to delete a device under "Devices". I select delete
> under "Choose an action" and the page reloads with the selected devices
> not deleted.
>
> OS RHEL6
> PHP version 5.6.30
> MySQL version 5.1.73
> Apache 2.2.31
>
> Any ideas what might be wrong? The database user can definitely write to
> the db and I don't get any errors in any logs. Any help appreciated.
>
> Wolfgang
>
>

It turn's out my Apache configuration was responsible for this behaviour.
I had a redirect in there that was confusing the cacti URLs. Sorry for the
noise.

Wolfgang

This version is obsolette use gitversion.

Please make an issue on github: https://github.com/Cacti/cacti

Regards
JK


On 08.03.2017 11:37, jer...@or... wrote:
> Hello,
>
> I am a student at the University of Lille, in France
> I begin my studies in network security.
> I have to present a vulnerability : CVE-2016-3172 (SQL Injection / tree.php) + CVE-2015-8604 (SQL Injection / graphs_new.php)
>
> For CVE-2015-8604 :
> http://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2015-8604
> http://www.openwall.com/lists/oss-security/2016/03/10/13
>
> Can you explain this vulnerability :
> - how to reproduce it ?
> - how to correct it?
> "The parameter parent_id is used without any validation."
>
> - Can you explain what the "parent_id" is, what is its function?
>
> - What is the impact ? An example ?
>
>
>
> I don't have access to cacti bug tracker :
>
> - Can you give me a copy of the cacti bug tracker :
>
> - Can you tell me, how this CVE was corrected ? The simple principle ?
>
>
>
> the same thing for CVE-2016-3172
>
> https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2016-3172
>
> thank you
>
> Cordialement
>
> [Logo Orange]<http://www.orange.com/>
>   Jérôme Strabach
> Analyste Qualité de fonctionnement du Réseaux Cœur Voix
> ORANGE/OF/DTSI/DERS/DR/DRM/VMI/CCI ET PERF
> Lyon Sévigné
> Mobile : +33 6 71 54 75 23 <https://monsi.sso.francetelecom.fr/index.asp?target=http%3A%2F%2Fclicvoice.sso.francetelecom.fr%2FClicvoiceV2%2FToolBar.do%3Faction%3Ddefault%26rootservice%3DSIGNATURE%26to%3D+33%206%2071%2054%2075%2023>
> jer...@or...<mailto:jer...@or...>
>
> [cid:image002.png@01D297FD.49A313F0]
>
>
> _________________________________________________________________________________________________________________________
>
> Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
> pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
> a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
> Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
>
> This message and its attachments may contain confidential or privileged information that may be protected by law;
> they should not be distributed, used or copied without authorisation.
> If you have received this email in error, please notify the sender and delete this message and its attachments.
> As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
> Thank you.
>
>
>
>
> ------------------------------------------------------------------------------
> Announcing the Oxford Dictionaries API! The API offers world-renowned
> dictionary content that is easy and intuitive to access. Sign up for an
> account today to start using our lexical data to power your apps and
> projects. Get started today and enter our developer competition.
> http://sdm.link/oxford
>
>
> _______________________________________________
> cacti-user mailing list
> cac...@li...
> https://lists.sourceforge.net/lists/listinfo/cacti-user

-- 
Jarosław Kłopotek
kom. 607 893 111
Interduo Ł. Bujek, J. Kłopotek, J. Sowa s.c.
ul. Lubelska 36B/40, 21-100 Lubartów
tel. 81 475 30 00

Hello,

I am a student at the University of Lille, in France
I begin my studies in network security.
I have to present a vulnerability : CVE-2016-3172 (SQL Injection / tree.php) + CVE-2015-8604 (SQL Injection / graphs_new.php)

For CVE-2015-8604 :
http://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2015-8604
http://www.openwall.com/lists/oss-security/2016/03/10/13

Can you explain this vulnerability :
- how to reproduce it ?
- how to correct it?
"The parameter parent_id is used without any validation."

- Can you explain what the "parent_id" is, what is its function?

- What is the impact ? An example ?



I don't have access to cacti bug tracker :

- Can you give me a copy of the cacti bug tracker :

- Can you tell me, how this CVE was corrected ? The simple principle ?



the same thing for CVE-2016-3172

https://www.cvedetails.com/cve-details.php?t=1&cve_id=CVE-2016-3172

thank you

Cordialement

[Logo Orange]<http://www.orange.com/>
 Jérôme Strabach
Analyste Qualité de fonctionnement du Réseaux Cœur Voix
ORANGE/OF/DTSI/DERS/DR/DRM/VMI/CCI ET PERF
Lyon Sévigné
Mobile : +33 6 71 54 75 23 <https://monsi.sso.francetelecom.fr/index.asp?target=http%3A%2F%2Fclicvoice.sso.francetelecom.fr%2FClicvoiceV2%2FToolBar.do%3Faction%3Ddefault%26rootservice%3DSIGNATURE%26to%3D+33%206%2071%2054%2075%2023>
jer...@or...<mailto:jer...@or...>

[cid:image002.png@01D297FD.49A313F0]


_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

Hi,

I did an upgrade from 0.8.8g to 1.0.4 and it went quite well, I can login
to the web interface, graphs are updating, but I can't make any changes
through the web interface.

For example if I go to Settings, and try to change the path for the cacti
log, hit "Save" and the page reloads with the old path still showing.

Same happens if I try to delete a device under "Devices". I select delete
under "Choose an action" and the page reloads with the selected devices
not deleted.

OS RHEL6
PHP version 5.6.30
MySQL version 5.1.73
Apache 2.2.31

Any ideas what might be wrong? The database user can definitely write to
the db and I don't get any errors in any logs. Any help appreciated.

Wolfgang

Please update to git version. The problem not exists.


On 03.03.2017 18:20, Danny Cox wrote:
> After moving the thold plugin into the plugins folder, I am no longer able to see any plugins.
>
> If I remove it, I am then able to manage all previously installed plugins.
>
> Version 0.8.8h on Windows 2012 server.
>
> Thanks,
>
> Danny H. Cox
> Infrastructure Manager
> Off:  (408) 514 6549
> Cell: (408) 313-3937
> dan...@vi...<mailto:dan...@vi...>
> [cid:image001.jpg@01CDD917.A2599EF0]
> www.viewglass.com<http://www.viewglass.com/>
>
>
>
>
> This message and any attachments may contain confidential information of View, Inc. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and delete the message from your computer.
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>
>
> _______________________________________________
> cacti-user mailing list
> cac...@li...
> https://lists.sourceforge.net/lists/listinfo/cacti-user

-- 
Jarosław Kłopotek
kom. 607 893 111
Interduo Ł. Bujek, J. Kłopotek, J. Sowa s.c.
ul. Lubelska 36B/40, 21-100 Lubartów
tel. 81 475 30 00

After moving the thold plugin into the plugins folder, I am no longer able to see any plugins.

If I remove it, I am then able to manage all previously installed plugins.

Version 0.8.8h on Windows 2012 server.

Thanks,

Danny H. Cox
Infrastructure Manager
Off:  (408) 514 6549
Cell: (408) 313-3937
dan...@vi...<mailto:dan...@vi...>
[cid:image001.jpg@01CDD917.A2599EF0]
www.viewglass.com<http://www.viewglass.com/>




This message and any attachments may contain confidential information of View, Inc. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and delete the message from your computer.

*** Release of Cacti 1.0.4 ***

We the Cacti Group are proud to release the following:

     Cacti 1.0.4
     Spine 1.0.4

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti Change Log ***
   feature: Javascript: make menu movement smooth and use localStorage
   feature:: Added cacti_snmp_get_raw() for plugin developers
   issue#288: Function cacti_snmp_get bad handling of wierd value into
              snmp_value
   issue#298: Graph generation issue with SNMP - Bits/Sec + Total
              Bandwith
   issue#301: Unresolvable DNS hostname causing backtraces
   issue#302: spikekill memory leak
   issue#303: Error when creating tree items with "&" in the name
   issue#307: Aggregate graph gives CMDPHP errors
   issue#308: UI resize issue
   issue#309: Show "Save Successful" notification permanently
   issue#311: Graph thumbnail settings in profile setting does not work
   issue#320: Users can not change their own password
   issue#324: Aggregate template graph template JavaScript error
   issue#352: Add configurable auto-logout and page-reload options
   issue#329: Customize the favicon
   issue#334: primary key on poller output boost table not efficient/not
              being used correctly
   issue: Fixed issues with Dark theme
   issue: Fixed issues with Paw theme
   issue: Fix timespan calculation
   issue: Added misplaced join condition when generating RRDTool graphs
   issue: Fix the selection of timestan based on local_graph_id
          and rra_id
   issue: Correct error in discovery not adding devices
   issue: Action message did not always display
   issue: fix regex to use Domains like www.t-online.de
   issue: Properly align Order columns.
   issue: address renaming issues with tree items.
   issue: Add device snmp --version is ambiguous
   issue: SNMP Availability failed to report down devices - This only
          was occuring for cmd.php collector.
   issue: i18n remove embedded HTML syntax
   issue: Wrap menu items to avoid scrolling

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group

Hi,

I have recently installed the latest version of Cacti (1.0.3) but there seems to be a problem: If I browse to Console -> Management -> Data Sources there is no “Add” link in the top right hand of the “Data Sources” bar. So I am unable to add a new data source for a graph I need (it’s a script on a remote server that outputs a number using snmp’s extend functionality, so I need to create a separate data source with the specific OID to read the value).

The add button was there before I upgraded (from 0.8.8h)

Thanks,
Chris

*** Release of Cacti 1.0.3 ***

We the Cacti Group are proud to release the following:

     Cacti 1.0.3
     Spine 1.0.3

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti Change Log ***
   issue#297: Upgrade 0.8.8h to 1.0.0 fails to create
              poller_output_boost table
   issue: Added missing template import hash for 1.0.2

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group

*** Release of Cacti 1.0.2 ***

We the Cacti Group are proud to release the following:

     Cacti 1.0.2
     Spine 1.0.2

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti 1.0.2 Change Log ***

   issue#278: Correct Boost Status display issue
   issue#275: Permission View issue and Device Dropdown when in
              Classic Theme
   issue#270: Major Mib Cache corruption.  Rebuild your MIB Cache
              after upgrading
   issue: Resolve Cacti logo on Graphs page in Classic Theme

*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group

*** Release of Cacti 1.0.1 ***

We the Cacti Group are proud to release the following:

     Cacti 1.0.1
     Spine 1.0.1

For additional details check out the README located on GitHub.

https://github.com/Cacti/cacti/blob/develop/README.md

*** Contribute ***

Active development of Cacti is located on GitHub! Join us in making 
Cacti better, submit issues, fork and submit pull requests!

https://github.com/cacti/

*** Cacti 1.0.1 Change Log ***

  feature: SpikeKill allows filling range to last known good value
  issue#261: Add IPv4 and IPv6 Specific Counters to interfaces.xml
  issue#257: Poller Output Table not Empty WARNING messages in cacti.log
  issue#256: New Graph - Add Graph Items Fails (Data Sources shows None)
  issue#255: Errors Creating new Graphs - Undefined Index Errors
  issue#254: Unable to Properly add Data Source
  issue#251: Remote Data Collector stuck on upgrade page
  issue#247: Devices missing from tree device list
  issue#245: Drag and Drop in Tree Edit Erratic
  issue#243: SMTP Ping Failure with not SNMP Authentication
  issue#241: Authentication Method: None not functional
  issue#240: SQL error when install plugin
  issue#238: Duplicate color id's cause error during Upgrade
  issue#231: SNMPv3 - PHP ERROR WARNING: Fatal error: Unknown user name
             in file
  issue: Resolving visual issues with row counts.
  issue: When deleting Graphs prevent the removal of Data Sources that
         are still in use
  issue: Improve SNMP agent performance through SQL optimizations


*** Reporting Issues ***

http://www.cacti.net/issues.php

*** Download Cacti ***

http://www.cacti.net/download_cacti.php

*** Download Spine ***

http://www.cacti.net/spine_download.php


Thanks!
The Cacti Group