228 matches found
CVE-2020-15016
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter...
CVE-2020-15017
NeDi 1.9C is vulnerable to reflected cross-site scripting due to improper validation in Devices-Config.php. An attacker can inject arbitrary JavaScript via a crafted sta GET parameter, enabling client-side code execution. This is documented across multiple sources (NVD entry CVE-2020-15017 and re...
CVE-2020-15017
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...
NeDi Detection
Detection of NeDi. The script sends a connection request to the server and attempts to detect NeDi and to extract its version. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
NeDi < 1.7.090 Multiple Vulnerabilities
NeDi is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nedi:nedi"; ifdescription...
Cross site scripting
A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...
CVE-2018-20727
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...
Command injection
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...
CVE-2018-20731
A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...
CVE-2018-20728
A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...
CVE-2018-20727
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...
CVE-2018-20729
A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...
CVE-2018-20729
A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...
Cross site scripting
A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...
Cross site request forgery (csrf)
A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...
CVE-2018-20728
A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...
CVE-2018-20730
A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component...
CVE-2018-20730
A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component...