CVE-2018-20730

A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component...

CVE-2018-20731

A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...

CVE-2018-20727

CVE-2018-20727 affects NeDi prior to 1.7Cp3. The vulnerability allows authenticated users to perform server-side command execution via user-controlled parameters: flt (Nodes-Traffic.php), dv (Devices-Graph.php), or tit (drawmap.php). This is a command-injection flaw arising from insufficient inpu...

CVE-2018-20729

CVE-2018-20729 describes a reflected XSS in NeDi prior to 1.7Cp3, exploitable via the reg parameter in mh.php, allowing arbitrary script/HTML injection. The OpenVAS entry corroborates multiple vulnerabilities in NeDi

CVE-2018-20730

CVE-2018-20730 is a SQL injection in NeDi prior to 1.7Cp3, exploitable via the query.php component. The vulnerability allows any user to execute arbitrary SQL read commands, enabling potential data disclosure. The available documents confirm the affected product (NeDi), the vulnerable component (...

CVE-2018-20728

CVE-2018-20728: NeDi is affected by a CSRF vulnerability that enables privilege escalation via User-Management.php in all versions before 1.7Cp3. The provided sources describe the issue as a CSRF in NeDi but do not specify a fixed version or remediation steps. The connected documents confirm the ...

CVE-2018-20728

A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...

CVE-2018-20731

CVE-2018-20731 is a stored XSS vulnerability in NeDi prior to 1.7Cp3, exploitable via User-Chat.php. Public records in NVD/NVD-derived feeds describe that remote attackers can inject arbitrary web script or HTML. The connected feeds confirm NeDi versions affected up to at least 1.7Cp3 and referen...

PT-2019-10185

Name of the Vulnerable Software and Affected Versions: NeDi versions prior to 1.7Cp3 Description: The issue allows authenticated users to execute code on the server side. This can be achieved via the flt parameter to "Nodes-Traffic.php", the dv parameter to "Devices-Graph.php", or the tit paramet...

PT-2019-10187

Name of the Vulnerable Software and Affected Versions: NeDi versions prior to 1.7Cp3 Description: A reflected cross site scripting issue allows remote attackers to inject arbitrary web script or HTML via the reg parameter in "mh.php". Recommendations: For versions prior to 1.7Cp3, update to versi...

PT-2019-10186

Name of the Vulnerable Software and Affected Versions: NeDi versions prior to 1.7Cp3 Description: A cross site request forgery issue allows remote attackers to escalate privileges. The issue is related to the User-Management.php endpoint. Recommendations: For versions prior to 1.7Cp3, update to...

PT-2019-10189

Name of the Vulnerable Software and Affected Versions: NeDi versions prior to 1.7Cp3 Description: A SQL injection issue allows any user to execute arbitrary SQL read commands via the "query.php" component. Recommendations: For versions prior to 1.7Cp3, update to version 1.7Cp3 or later to resolve...

PT-2019-10190

Name of the Vulnerable Software and Affected Versions: NeDi versions prior to 1.7Cp3 Description: A stored cross site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the User-Chat.php file. Recommendations: For versions prior to 1.7Cp3, update to version...

CVE-2018-20729: Improper Neutralization of Input During Web Page Generation

A reflected cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php...

CVE-2018-20731: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting XSS vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php...

CVE-2018-20730: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component...

CVE-2018-20727: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php...

CVE-2018-20728: Cross-Site Request Forgery (CSRF)

A cross site request forgery CSRF vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php...

CVE-2013-3509

html/System-NeDi.php in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the scan functionality in the System / NeDi menu...

CVE-2013-3511

Open redirect vulnerability in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...