eonweb

CVEs (19)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2017-14403	Eyesofnetwork Eyesofnetwork	Cri	0.64	9.8	0.01	Sep 13, 2017	The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the term parameter to module/admin_group/search.php.
CVE-2017-14402	Eyesofnetwork Eyesofnetwork	Cri	0.64	9.8	0.01	Sep 13, 2017	The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php.
CVE-2017-14401	Eyesofnetwork Eyesofnetwork	Cri	0.64	9.8	0.01	Sep 13, 2017	The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT UPDATE" section.
CVE-2017-14252	Eyesofnetwork Eyesofnetwork	Cri	0.64	9.8	0.01	Sep 11, 2017	SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.
CVE-2017-14247	Eyesofnetwork Eyesofnetwork	Cri	0.64	9.8	0.01	Sep 11, 2017	SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the user_id cookie to header.php, a related issue to CVE-2017-1000060.
CVE-2017-6087	Eyesofnetwork Eyesofnetwork	Hig	0.61	8.8	0.07	Mar 24, 2017	EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4)…
CVE-2017-14119	Eyesofnetwork Eyesofnetwork	Hig	0.57	8.8	0.02	Sep 3, 2017	In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\snmpwalk.php does not properly restrict popen calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in a parameter.
CVE-2017-14118	Eyesofnetwork Eyesofnetwork	Hig	0.57	8.8	0.02	Sep 3, 2017	In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\interface.php does not properly restrict exec calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php.
CVE-2017-14404	Eyesofnetwork Eyesofnetwork	Hig	0.49	7.5	0.02	Sep 13, 2017	The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to module/tool_all/select_tool.php, as demonstrated by a tool_list=php://filter/ substring.
CVE-2017-13780	Eyesofnetwork Eyesofnetwork	Hig	0.49	7.5	0.02	Aug 30, 2017	The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.
CVE-2017-16000	Eyesofnetwork Eyesofnetwork	Hig	0.47	7.2	0.02	Oct 29, 2017	SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
CVE-2017-15933	Eyesofnetwork Eyesofnetwork	Hig	0.47	7.2	0.02	Oct 27, 2017	SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacity_per_device/index.php.
CVE-2017-15880	Eyesofnetwork Eyesofnetwork	Hig	0.47	7.2	0.02	Oct 24, 2017	SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php (for insert_group and…
CVE-2017-14405	Eyesofnetwork Eyesofnetwork	Hig	0.47	7.2	0.04	Sep 13, 2017	The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote command execution via shell metacharacters in a hosts_cacti array parameter to module/admin_device/index.php.
CVE-2017-14985	Eyesofnetwork Eyesofnetwork	Med	0.35	5.4	0.01	Oct 3, 2017	Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the url parameter to module/module_frame/index.php.
CVE-2017-14984	Eyesofnetwork Eyesofnetwork	Med	0.35	5.4	0.01	Oct 3, 2017	Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the bp_name parameter to /module/admin_bp/add_services.php.
CVE-2017-14753	Eyesofnetwork Eyesofnetwork	Med	0.35	5.4	0.01	Sep 27, 2017	Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/module_filters/index.php.
CVE-2017-15188	Eyesofnetwork Eyesofnetwork	Med	0.31	4.8	0.01	Oct 11, 2017	A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the hosts array parameter to module/admin_device/index.php.
CVE-2017-14983	Eyesofnetwork Eyesofnetwork	Med	0.31	4.8	0.01	Oct 3, 2017	Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the object parameter to module/admin_conf/index.php.

CVE-2017-14403CriSep 13, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.64cvss 9.8epss 0.01
The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the term parameter to module/admin_group/search.php.
CVE-2017-14402CriSep 13, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.64cvss 9.8epss 0.01
The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php.
CVE-2017-14401CriSep 13, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.64cvss 9.8epss 0.01
The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT UPDATE" section.
CVE-2017-14252CriSep 11, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.64cvss 9.8epss 0.01
SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.
CVE-2017-14247CriSep 11, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.64cvss 9.8epss 0.01
SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the user_id cookie to header.php, a related issue to CVE-2017-1000060.
CVE-2017-6087HigMar 24, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.61cvss 8.8epss 0.07
EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4)…
CVE-2017-14119HigSep 3, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.57cvss 8.8epss 0.02
In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\snmpwalk.php does not properly restrict popen calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in a parameter.
CVE-2017-14118HigSep 3, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.57cvss 8.8epss 0.02
In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\interface.php does not properly restrict exec calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php.
CVE-2017-14404HigSep 13, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.49cvss 7.5epss 0.02
The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to module/tool_all/select_tool.php, as demonstrated by a tool_list=php://filter/ substring.
CVE-2017-13780HigAug 30, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.49cvss 7.5epss 0.02
The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.
CVE-2017-16000HigOct 29, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.47cvss 7.2epss 0.02
SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
CVE-2017-15933HigOct 27, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.47cvss 7.2epss 0.02
SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacity_per_device/index.php.
CVE-2017-15880HigOct 24, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.47cvss 7.2epss 0.02
SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php (for insert_group and…
CVE-2017-14405HigSep 13, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.47cvss 7.2epss 0.04
The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote command execution via shell metacharacters in a hosts_cacti array parameter to module/admin_device/index.php.
CVE-2017-14985MedOct 3, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the url parameter to module/module_frame/index.php.
CVE-2017-14984MedOct 3, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the bp_name parameter to /module/admin_bp/add_services.php.
CVE-2017-14753MedSep 27, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script or HTML via the filter parameter to module/module_filters/index.php.
CVE-2017-15188MedOct 11, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.31cvss 4.8epss 0.01
A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the hosts array parameter to module/admin_device/index.php.
CVE-2017-14983MedOct 3, 2017
Eyesofnetwork
Eyesofnetwork
risk 0.31cvss 4.8epss 0.01
Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the object parameter to module/admin_conf/index.php.