CVE-2020-9465

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the userid field in a cookie...

Sql injection

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the userid field in a cookie...

CVE-2020-9465

EyesOfNetwork eonweb versions 5.1–5.3 (pre-5.3-3) contain a SQL injection in the API getApiKey function (username field) allowing unauthenticated access; exploitation is demonstrated in various advisories and modules (e.g., Metasploit exploit for EyesOfNetwork Autodiscovery). The issue can lead t...

CVE-2020-9465

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the userid field in a cookie...

EyesOfNetwork add_modify_group.php SQL Injection Vulnerability

EyesOfNetwork EON is an open source, free IT monitoring solution. The solution provides business process configuration tools, generating pop-up windows when events occur in the active queue, etc. EyesOfNetwork web interface aka eonweb is one of the web interfaces. A SQL injection vulnerability...

CVE-2017-16000

EyesOfNetwork (eonweb) 5.1-0 has a SQL injection in the web interface via the graph parameter to module/capacity_per_label/index.php. The vulnerability affects authenticated remote administrators who can inject SQL, enabling arbitrary commands. Multiple connected sources (RH, CNVD, CVE listings, ...

CVE-2017-15880

SQL injection vulnerability vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the groupname parameter to module/admingroup/addmodifygroup.php for insertgroup and updategroup...

CVE-2017-15880

CVE-2017-15880 affects EyesOfNetwork web interface (eonweb) 5.1-0. Affected component: module/admin_group/add_modify_group.php (for insert_group and update_group). Root cause: SQL injection via the group_name parameter. Impact as described: remote authenticated administrators could execute arbitr...

CVE-2017-15188

EyesOfNetwork (EON) web interface (eonweb) 5.1-0 has a stored XSS vulnerability exploitable via the hosts array parameter in module/admin_device/index.php. Reported as CVE-2017-15188, the issue permits remote authenticated administrators to inject arbitrary script/HTML. Multiple connected sources...

CVE-2017-15188

A persistent stored XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the hosts array parameter to module/admindevice/index.php...

CVE-2017-14983

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the object parameter to module/adminconf/index.php...

CVE-2017-14984

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the bpname parameter to /module/adminbp/addservices.php...

CVE-2017-14985

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the url parameter to module/moduleframe/index.php...

CVE-2017-14983

CVE-2017-14983 is a cross-site scripting (XSS) vulnerability in EyesOfNetwork web interface (eonweb) 5.1-0. It allows remote authenticated administrators to inject arbitrary web script or HTML via the object parameter to module/admin_conf/index.php. Impact described in sources is consistent with ...

CVE-2017-14985

The EyesOfNetwork web interface (eonweb) is affected by CVE-2017-14985, an XSS in 5.1-0 that allows remote authenticated users to inject arbitrary script/HTML via the url parameter to module/module_frame/index.php. Reported impact includes reflected/script injection with low to medium severity (C...

CVE-2017-14984

EyesOfNetwork (eonweb) 5.1-0 is affected by a cross-site scripting (XSS) vulnerability. A remote authenticated user can inject arbitrary web script/HTML via the bp_name parameter to /module/admin_bp/add_services.php. The issue is documented in CVE-2017-14984; CVSS base scores in sources range fro...

CVE-2017-14753

CVE-2017-14753 is an XSS vulnerability in EyesOfNetwork (eonweb) 5.1-0 where remote authenticated users can inject arbitrary web script or HTML by supplying a crafted filter parameter to module/module_filters/index.php. Multiple connected sources corroborate this: the CNVD entry details the same ...

The vulnerability of the eonweb (logout.php) component of the support service program, designed for implementing the library process (ITIL), EyesOfNetwork, allows a hacker to circumvent access control rules.

The vulnerability of the eonweb logout.php component of the support service program, designed for implementing ITIL library processes, relates to the lack of protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to bypass access restrictions and gain remote...

CVE-2017-14403

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the term parameter to module/admingroup/search.php...

CVE-2017-14404

Affected software: EyesOfNetwork web interface (eonweb) 5.1-0. Vulnerability type: Local File Inclusion via the tool_list parameter (aka url_tool) to module/tool_all/select_tool.php. Root cause / vector: Untrusted tool_list input can be used to include local files (demonstrated by tool_list=php:/...