Priority MEDIUM 47
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit…
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.05609 · Published 2019-01-17 · No fix listed CWE-78
Priority MEDIUM 45
NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.01164 · Published 2021-02-12 · No fix listed CWE-863
Priority MEDIUM 44
NeDi 1.9C is vulnerable to Remote Command Execution.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03711 · Published 2020-06-29 · No fix listed CWE-78
Priority MEDIUM 44
NeDi 1.9C is vulnerable to Remote Command Execution.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03711 · Published 2020-06-29 · No fix listed CWE-78
Priority MEDIUM 43
In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulnerability.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02065 · Published 2022-10-06 · No fix listed CWE-203
Priority MEDIUM 41
NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01508 · Published 2021-02-12 · No fix listed CWE-78
Priority MEDIUM 41
NeDi 1.9C allows an authenticated user to perform a SQL Injection in the Monitoring History function on the endpoint /Monitoring-History.php via the det HTTP GET parameter.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01242 · Published 2021-02-12 · No fix listed CWE-89
Priority LOW 39
A cross site request forgery (CSRF) vulnerability in NeDi before 1.7Cp3 allows remote attackers to escalate privileges via User-Management.php.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00593 · Published 2019-01-17 · No fix listed CWE-352
Priority LOW 35
A SQL injection vulnerability in NeDi before 1.7Cp3 allows any user to execute arbitrary SQL read commands via the query.php component.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01187 · Published 2019-01-17 · No fix listed CWE-89
Priority LOW 33
NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03472 · Published 2020-06-29 · No fix listed CWE-79
Priority LOW 29
A stored cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00804 · Published 2019-01-17 · No fix listed CWE-79
Priority LOW 29
A reflected cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via the reg parameter in mh.php.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00804 · Published 2019-01-17 · No fix listed CWE-79
Priority LOW 28
NeDi 1.9C is vulnerable to reflected cross-site scripting.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00649 · Published 2020-06-26 · No fix listed CWE-79
Priority LOW 28
NeDi 1.9C is vulnerable to reflected cross-site scripting.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00649 · Published 2020-06-26 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C allows pwsec.php oid XSS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00557 · Published 2020-11-02 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C allows inc/rt-popup.php d XSS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00531 · Published 2020-11-02 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00545 · Published 2020-07-07 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00545 · Published 2020-07-07 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00532 · Published 2020-07-07 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00568 · Published 2020-07-07 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00557 · Published 2020-07-07 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00568 · Published 2020-07-07 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00568 · Published 2020-07-07 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00568 · Published 2020-07-07 · No fix listed CWE-79
Priority LOW 25
NeDi 1.9C is vulnerable to cross-site scripting (XSS) attack.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00568 · Published 2020-07-07 · No fix listed CWE-79
Load more
THREATIST.IORead the docs