CVE-2020-24390

eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/adminlogs page, which might allow pre-authentication stored XSS during login/logout logs recording...

CVE-2020-24390

eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/adminlogs page, which might allow pre-authentication stored XSS during login/logout logs recording...

Cross site scripting

eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/adminlogs page, which might allow pre-authentication stored XSS during login/logout logs recording...

CVE-2020-24390

eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/adminlogs page, which might allow pre-authentication stored XSS during login/logout logs recording...

CVE-2020-24390

CVE-2020-24390 affects EyesOfNetwork’s web interface (eonweb), specifically pre-5.3-7 builds. The vulnerability is a lack of proper escaping of the username on the /module/admin_logs page, which can allow pre-authentication stored XSS in login/logout logs. Public sources confirm affected versions...

EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'EyesOfNetwork AutoDiscovery Target Command Execution', 'Description' = %q This module exploits multiple vulnerabilities in EyesOfNetwork version...

EyesOfNetwork AutoDiscovery Target Command Execution Exploit

This Metasploit module exploits multiple vulnerabilities in EyesOfNetwork version 5.3 and prior in order to execute arbitrary commands as root. This module takes advantage of a command injection vulnerability in the target parameter of the AutoDiscovery functionality within the EON web interface ...

EyesOfNetwork AutoDiscovery Target Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'EyesOfNetwork AutoDiscovery Target Command Execution', 'Description' = %q This module exploits multiple vulnerabilities in EyesOfNetwork version...

CVE-2020-9465

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the userid field in a cookie...

CVE-2020-9465

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the userid field in a cookie...

Sql injection

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the userid field in a cookie...

CVE-2020-9465

EyesOfNetwork eonweb versions 5.1–5.3 (pre-5.3-3) contain a SQL injection in the API getApiKey function (username field) allowing unauthenticated access; exploitation is demonstrated in various advisories and modules (e.g., Metasploit exploit for EyesOfNetwork Autodiscovery). The issue can lead t...

CVE-2020-9465

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the userid field in a cookie...

Unspecified Vulnerability in EyesOfNetwork

EyesOfNetwork EON is an open source, free IT monitoring solution. The solution provides features such as a business process configuration tool, generating pop-up windows when events occur in the active queue, and more. A security vulnerability exists in EyesOfNetwork. An attacker exploited the...

EyesOfNetwork 5.3 Remote Code Execution

Exploit Title: EyesOfNetwork 5.3 - Remote Code Execution Date: 2020-02-01 Exploit Author: Clément Billac Vendor Homepage: https://www.eyesofnetwork.com/ Software Link: http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x8664-bin.iso Version: 5.3 CVE : CVE-2020-8654, CVE-2020-8655, CVE-2020-8656...

CVE-2020-8656

An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/apifunctions.php...

CVE-2020-8654

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

CVE-2020-8654

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

CVE-2020-8655

An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7...

CVE-2020-8656

An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/apifunctions.php...