EUVD-2020-16725

Malware in sbrugna...

NeDi <= 1.9C Multiple XSS Vulnerabilities

NeDi is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2020-23989

NeDi 1.9C allows pwsec.php oid XSS...

CVE-2020-23989

NeDi 1.9C allows pwsec.php oid XSS...

Cross site scripting

NeDi 1.9C allows pwsec.php oid XSS...

CVE-2020-23989

NeDi 1.9C allows pwsec.php oid XSS...

CVE-2020-23989

NeDi 1.9C contains a cross-site scripting vulnerability in pwsec.php (XSS via pwsec.php oid). The CVE entry CVE-2020-23989 documents a pwsec.php oid XSS affecting NeDi 1.9C. Connected sources (CNVD-2020-62487, OPENVAS) corroborate multiple XSS vulnerabilities in NeDi

PT-2020-15617

Name of the Vulnerable Software and Affected Versions NeDi version 1.9C Description The issue allows for XSS through the oid parameter in pwsec.php. Recommendations For NeDi version 1.9C, avoid using the oid parameter in the pwsec.php file until a fix is available. Consider restricting access to...

NeDi Consulting Unspecified Vulnerability in NeDi

NeDi Consulting NeDi is a suite of open source software that supports the discovery and mapping of network devices from the Swiss company NeDi Consulting. A security vulnerability exists in NeDi Consulting NeDi version 1.9C, which stems from the pwsec.php file not properly escaping shell...

CVE-2020-14414

NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...

CVE-2020-14414

NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...

Cross site request forgery (csrf)

NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...

CVE-2020-14414

CVE-2020-14414 affects NeDi 1.9C. The pwsec.php component fails to safely escape shell metacharacters in a POST request parameter (pw), leading to Remote Command Execution. An attacker can craft an arbitrary command payload containing shell metacharacters via a POST request, with CSRF potentially...

CVE-2020-14414

NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...

PT-2020-13995

Name of the Vulnerable Software and Affected Versions NeDi version 1.9C Description The issue allows for Remote Command Execution due to improper escaping of shell metacharacters from a POST request in the pwsec.php file. An attacker can exploit this by sending a crafted payload containing shell...

CVE-2020-14414: Improper Neutralization of Special Elements used in an OS Command

NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload any system commands that contains shell metacharacters via a POST request with a pw parameter. This can also be...