Show filters
36 Total Results
Displaying 11-20 of 36
Sort by:
Attacker Value
Unknown
CVE-2020-24390
Disclosure Date: August 27, 2020 (last updated February 22, 2025)
eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording.
0
Attacker Value
Unknown
CVE-2020-8656
Disclosure Date: February 07, 2020 (last updated February 21, 2025)
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.
0
Attacker Value
Unknown
CVE-2020-8655
Disclosure Date: February 07, 2020 (last updated February 21, 2025)
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
0
Attacker Value
Unknown
CVE-2020-8654
Disclosure Date: February 07, 2020 (last updated February 21, 2025)
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.
0
Attacker Value
Unknown
CVE-2020-8657
Disclosure Date: February 06, 2020 (last updated February 21, 2025)
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.
0
Attacker Value
Unknown
CVE-2019-14923
Disclosure Date: August 16, 2019 (last updated November 27, 2024)
EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field.
0
Attacker Value
Unknown
CVE-2017-16000
Disclosure Date: October 29, 2017 (last updated November 26, 2024)
SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
0
Attacker Value
Unknown
CVE-2017-15933
Disclosure Date: October 27, 2017 (last updated November 26, 2024)
SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacity_per_device/index.php.
0
Attacker Value
Unknown
CVE-2017-15880
Disclosure Date: October 24, 2017 (last updated November 26, 2024)
SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php (for insert_group and update_group).
0
Attacker Value
Unknown
CVE-2017-15188
Disclosure Date: October 11, 2017 (last updated November 26, 2024)
A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the hosts array parameter to module/admin_device/index.php.
0
