228 matches found
CVE-2020-15016
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the txt GET parameter...
CVE-2020-15017
NeDi 1.9C is vulnerable to reflected cross-site scripting due to improper validation in Devices-Config.php. An attacker can inject arbitrary JavaScript via a crafted sta GET parameter, enabling client-side code execution. This is documented across multiple sources (NVD entry CVE-2020-15017 and re...
CVE-2020-15017
NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...
NeDi Detection
Detection of NeDi. The script sends a connection request to the server and attempts to detect NeDi and to extract its version. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
NeDi < 1.7.090 Multiple Vulnerabilities
NeDi is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:nedi:nedi"; ifdescription...
Cross site scripting
A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...
CVE-2018-20727
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...
CVE-2018-20728
A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...
CVE-2018-20731
A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...
Command injection
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...
CVE-2018-20727
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...
CVE-2018-20729
A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...
CVE-2018-20729
A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...
Sql injection
A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component...
CVE-2018-20730
A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component...
CVE-2018-20728
A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...
Cross site scripting
A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...
Cross site request forgery (csrf)
A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...