CVE-2018-20728

A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...

CVE-2018-20731

A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...

CVE-2018-20727

Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...

CVE-2018-20731

CVE-2018-20731 is a stored XSS vulnerability in NeDi prior to 1.7Cp3, exploitable via User-Chat.php. Public records in NVD/NVD-derived feeds describe that remote attackers can inject arbitrary web script or HTML. The connected feeds confirm NeDi versions affected up to at least 1.7Cp3 and referen...

CVE-2018-20727

CVE-2018-20727 affects NeDi prior to 1.7Cp3. The vulnerability allows authenticated users to perform server-side command execution via user-controlled parameters: flt (Nodes-Traffic.php), dv (Devices-Graph.php), or tit (drawmap.php). This is a command-injection flaw arising from insufficient inpu...

CVE-2018-20729

CVE-2018-20729 describes a reflected XSS in NeDi prior to 1.7Cp3, exploitable via the reg parameter in mh.php, allowing arbitrary script/HTML injection. The OpenVAS entry corroborates multiple vulnerabilities in NeDi

CVE-2018-20729

A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...

CVE-2018-20730

CVE-2018-20730 is a SQL injection in NeDi prior to 1.7Cp3, exploitable via the query.php component. The vulnerability allows any user to execute arbitrary SQL read commands, enabling potential data disclosure. The available documents confirm the affected product (NeDi), the vulnerable component (...

CVE-2018-20728

CVE-2018-20728: NeDi is affected by a CSRF vulnerability that enables privilege escalation via User-Management.php in all versions before 1.7Cp3. The provided sources describe the issue as a CSRF in NeDi but do not specify a fixed version or remediation steps. The connected documents confirm the ...

CVE-2013-3509

html/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu...

CVE-2013-3511

Open redirect vulnerability in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2013-3508

html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors involving file editing...

CVE-2013-3501

Multiple cross-site scripting XSS vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the foundation-webapp/admin/ directory, 2 the NeDi component, or 3 the Noma component...

CVE-2013-3507

The NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to obtain sensitive information via a direct request for 1 a configuration file, 2 a database dump, or 3 the Tomcat status context...

Sql injection

Multiple SQL injection vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote authenticated users to execute arbitrary SQL commands via 1 nedi/html/System-Export.php, 2 nedi/html/Devices-List.php, or 3 the Noma component...

Open redirect

Open redirect vulnerability in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

Design/Logic Flaw

html/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu...

Design/Logic Flaw

html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors involving file editing...

Information disclosure

The NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to obtain sensitive information via a direct request for 1 a configuration file, 2 a database dump, or 3 the Tomcat status context...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in GroundWork Monitor Enterprise 6.7.0 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the foundation-webapp/admin/ directory, 2 the NeDi component, or 3 the Noma component...