CVE-2017-14985

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the url parameter to module/moduleframe/index.php...

CVE-2017-14985: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the url parameter to module/moduleframe/index.php...

CVE-2017-14984: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the bpname parameter to /module/adminbp/addservices.php...

CVE-2017-14983: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the object parameter to module/adminconf/index.php...

CVE-2017-14983

CVE-2017-14983 is a cross-site scripting (XSS) vulnerability in EyesOfNetwork web interface (eonweb) 5.1-0. It allows remote authenticated administrators to inject arbitrary web script or HTML via the object parameter to module/admin_conf/index.php. Impact described in sources is consistent with ...

CVE-2017-14984

EyesOfNetwork (eonweb) 5.1-0 is affected by a cross-site scripting (XSS) vulnerability. A remote authenticated user can inject arbitrary web script/HTML via the bp_name parameter to /module/admin_bp/add_services.php. The issue is documented in CVE-2017-14984; CVSS base scores in sources range fro...

CVE-2017-14985

The EyesOfNetwork web interface (eonweb) is affected by CVE-2017-14985, an XSS in 5.1-0 that allows remote authenticated users to inject arbitrary script/HTML via the url parameter to module/module_frame/index.php. Reported impact includes reflected/script injection with low to medium severity (C...

CVE-2017-14753

CVE-2017-14753 is an XSS vulnerability in EyesOfNetwork (eonweb) 5.1-0 where remote authenticated users can inject arbitrary web script or HTML by supplying a crafted filter parameter to module/module_filters/index.php. Multiple connected sources corroborate this: the CNVD entry details the same ...

CVE-2017-14753: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/modulefilters/index.php...

The vulnerability of the eonweb (logout.php) component of the support service program, designed for implementing the library process (ITIL), EyesOfNetwork, allows a hacker to circumvent access control rules.

The vulnerability of the eonweb logout.php component of the support service program, designed for implementing ITIL library processes, relates to the lack of protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to bypass access restrictions and gain remote...

CVE-2017-14403

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the term parameter to module/admingroup/search.php...

CVE-2017-14401

The EyesOfNetwork web interface (eonweb) 5.1-0 contains a SQL injection vulnerability in the USERNAME column, exploitable via the user_name parameter to module/admin_user/add_modify_user.php within the ACCOUNT UPDATE section. This allows an attacker to construct arbitrary SQL commands, enabling d...

CVE-2017-14404

Affected software: EyesOfNetwork web interface (eonweb) 5.1-0. Vulnerability type: Local File Inclusion via the tool_list parameter (aka url_tool) to module/tool_all/select_tool.php. Root cause / vector: Untrusted tool_list input can be used to include local files (demonstrated by tool_list=php:/...

CVE-2017-14404: Exposure of Sensitive Information to an Unauthorized Actor

The EyesOfNetwork web interface aka eonweb 5.1-0 allows local file inclusion via the toollist parameter aka the urltool variable to module/toolall/selecttool.php, as demonstrated by a toollist=php://filter/ substring...

CVE-2017-14401: Improper Neutralization of Special Elements used in an SQL Command

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT UPDATE" section...

CVE-2017-14402: Improper Neutralization of Special Elements used in an SQL Command

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...

CVE-2017-14405: Improper Neutralization of Special Elements used in an OS Command

The EyesOfNetwork web interface aka eonweb 5.1-0 allows remote command execution via shell metacharacters in a hostscacti array parameter to module/admindevice/index.php...

PT-2017-13446

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface aka eonweb version 5.1-0 Description The issue concerns SQL injection via the term parameter to the "module/admin group/search.php" API endpoint. Recommendations For EyesOfNetwork web interface aka eonweb version...

CVE-2017-14247

The CVE-2017-14247 issue affects EyesOfNetwork (EON) web interface, eonweb, version 5.1-0, via an SQL injection in header.php triggered by the user_id cookie. Connected sources corroborate a SQL injection path in eonweb that can be exploited remotely, with descriptions indicating unauthenticated ...

CVE-2017-14252: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in the EyesOfNetwork web interface aka eonweb 5.1-0 via the groupid cookie to side.php...