CVE-2020-15029: Improper Neutralization of Input During Web Page Generation

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php sn parameter...

CVE-2020-15037: Improper Neutralization of Input During Web Page Generation

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Reports-Devices.php page st parameter...

CVE-2020-15035: Improper Neutralization of Input During Web Page Generation

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Map.php hde parameter...

CVE-2020-15033: Improper Neutralization of Input During Web Page Generation

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the snmpget.php ip parameter...

CVE-2020-15028: Improper Neutralization of Input During Web Page Generation

NeDi 1.9C is vulnerable to a cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Map.php xo parameter...

CVE-2020-15032: Improper Neutralization of Input During Web Page Generation

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Incidents.php id parameter...

CVE-2020-15030: Improper Neutralization of Input During Web Page Generation

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Routes.php rtr parameter...

CVE-2020-15031: Improper Neutralization of Input During Web Page Generation

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php chg parameter...

NeDi Consulting NeDi Cross-Site Scripting Vulnerability (CNVD-2020-44584)

NeDi Consulting NeDi is a suite of open source software that supports the discovery and mapping of network devices from the Swiss company NeDi Consulting. NeDi Consulting A cross-site scripting vulnerability exists in the 'sanitize' function of the inc/libmisc.php file in NeDi version 1.9C. The...

Unspecified Vulnerability in NeDi Consulting NeDi (CNVD-2020-44583)

NeDi Consulting NeDi is a suite of open source software that supports discovery and mapping of network devices from the Swiss company NeDi Consulting. A security vulnerability exists in NeDi Consulting NeDi version 1.9C, which stems from the System-Snapshot.php file not properly escaping shell...

NeDi Consulting Unspecified Vulnerability in NeDi

NeDi Consulting NeDi is a suite of open source software that supports the discovery and mapping of network devices from the Swiss company NeDi Consulting. A security vulnerability exists in NeDi Consulting NeDi version 1.9C, which stems from the pwsec.php file not properly escaping shell...

CVE-2020-14414

NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...

CVE-2020-14412

NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a psw parameter. This...

CVE-2020-14413

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta=...

CVE-2020-14414

NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...

CVE-2020-14412

NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a psw parameter. This...

CVE-2020-14413

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta=...

Cross site request forgery (csrf)

NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...

Design/Logic Flaw

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta=...

Cross site request forgery (csrf)

NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a psw parameter. This...