257 matches found
CVE-2020-14414
CVE-2020-14414 affects NeDi 1.9C. The pwsec.php component fails to safely escape shell metacharacters in a POST request parameter (pw), leading to Remote Command Execution. An attacker can craft an arbitrary command payload containing shell metacharacters via a POST request, with CSRF potentially...
CVE-2020-14414
NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...
CVE-2020-14413
NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta=...
CVE-2020-14413
Summary of CVE-2020-14413 : NeDi 1.9C is vulnerable to cross-site scripting due to an incorrect implementation of sanitize() in inc/libmisc.php. The function attempts to escape SCRIPT tags from user-controlled values but can be bypassed, with an example using an onerror attribute in an IMG tag (D...
CVE-2020-14412
NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a psw parameter. This...
CVE-2020-14412
CVE-2020-14412 affects NeDi 1.9C. The System-Snapshot.php file fails to properly escape shell metacharacters from POST requests, enabling potential Remote Command Execution via a crafted payload in the psw parameter; CSRF also noted as a possibility. Documents confirm the vulnerability vector and...
CVE-2020-14413: Improper Neutralization of Input During Web Page Generation
NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta=...
CVE-2020-14414: Improper Neutralization of Special Elements used in an OS Command
NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...
CVE-2020-14412: Improper Neutralization of Special Elements used in an OS Command
NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a psw parameter. This...
NeDi Consulting NeDi Cross-Site Scripting Vulnerability (CNVD-2020-44586)
NeDi Consulting NeDi is a suite of open source software that supports the discovery and mapping of network devices from the Swiss company NeDi Consulting. A cross-site scripting vulnerability exists in NeDi Consulting NeDi version 1.9C. The vulnerability stems from a lack of proper validation of...
NeDi Consulting NeDi Cross-Site Scripting Vulnerability (CNVD-2020-44587)
NeDi Consulting NeDi is a suite of open source software that supports the discovery and mapping of network devices from the Swiss company NeDi Consulting. A cross-site scripting vulnerability exists in NeDi Consulting NeDi version 1.9C. The vulnerability stems from a lack of proper validation of...
CVE-2020-15016
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter...
CVE-2020-15017
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...
Cross site scripting
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter...
Cross site scripting
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...
CVE-2020-15016
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter...
CVE-2020-15016
NeDi 1.9C is affected by a reflected cross-site scripting vulnerability. The issue arises in the web application’s Other-Converter.php, where user input is not properly validated, allowing an attacker to craft arbitrary JavaScript via the txt GET parameter. Multiple sources in the connected set (...
CVE-2020-15016
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter...
CVE-2020-15017
NeDi 1.9C is vulnerable to reflected cross-site scripting due to improper validation in Devices-Config.php. An attacker can inject arbitrary JavaScript via a crafted sta GET parameter, enabling client-side code execution. This is documented across multiple sources (NVD entry CVE-2020-15017 and re...
CVE-2020-15017
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...