CVE-2022-41572 | Critical | 9.8 | 2025-01-07 | An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server because nmap can be run as root. The atta… |
CVE-2022-41434 | Medium | 6.1 | 2022-11-08 | EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/main.php. |
CVE-2022-41433 | Medium | 4.8 | 2022-11-08 | EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/admin_bp/add_applicat… |
CVE-2022-41432 | Medium | 4.8 | 2022-11-08 | EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/report_event/index.ph… |
CVE-2022-41571 | Critical | 9.8 | 2022-09-27 | An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur. |
CVE-2022-41570 | Critical | 9.8 | 2022-09-27 | An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur. |
CVE-2021-40643 | Critical | 9.8 | 2022-06-30 | EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application… |
CVE-2022-24612 | Medium | 5.4 | 2022-02-25 | An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS. |
CVE-2021-33525 | High | 8.8 | 2021-05-24 | EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution (by authenticated users) via shell metacharacters in the nagios_path parameter to lilac/exp… |
CVE-2021-27514 | Critical | 9.8 | 2021-02-22 | EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication bypass (such as in… |
CVE-2021-27513 | High | 8.8 | 2021-02-22 | The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le filtre userside." |
CVE-2020-27887 | High | 8.8 | 2020-10-29 | An issue was discovered in EyesOfNetwork 5.3 through 5.3-8. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run ar… |
CVE-2020-27886 | Critical | 9.8 | 2020-10-29 | An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker… |
CVE-2020-24390 | Medium | 6.1 | 2020-08-27 | eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS duri… |
CVE-2020-9465 | Critical | 9.8 | 2020-02-28 | An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated… |
CVE-2020-8656 | Critical | 9.8 | 2020-02-07 | An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various ta… |
CVE-2020-8655 | High | 7.8 | 2020-02-07 | An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbit… |
CVE-2020-8654 | High | 8.8 | 2020-02-07 | An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS com… |
CVE-2020-8657 | Critical | 9.8 | 2020-02-06 | An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4… |
CVE-2019-14923 | High | 8.8 | 2019-08-16 | EyesOfNetwork 5.1 allows Remote Command Execution via shell metacharacters in the module/tool_all/ host field. |
CVE-2017-16000 | High | 7.2 | 2017-10-29 | SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands… |
CVE-2017-15933 | High | 7.2 | 2017-10-27 | SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary… |
CVE-2017-15880 | High | 7.2 | 2017-10-24 | SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary… |
CVE-2017-15188 | Medium | 4.8 | 2017-10-11 | A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary we… |
CVE-2017-14985 | Medium | 5.4 | 2017-10-03 | Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script… |
CVE-2017-14984 | Medium | 5.4 | 2017-10-03 | Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script… |
CVE-2017-14983 | Medium | 4.8 | 2017-10-03 | Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary w… |
CVE-2017-14753 | Medium | 5.4 | 2017-09-27 | Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject arbitrary web script… |
CVE-2017-14405 | High | 7.2 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote command execution via shell metacharacters in a hosts_cacti array parameter to module/admin_de… |
CVE-2017-14404 | High | 7.5 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to module/tool_all/selec… |
CVE-2017-14403 | Critical | 9.8 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the term parameter to module/admin_group/search.php. |
CVE-2017-14402 | Critical | 9.8 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT CREAT… |
CVE-2017-14401 | Critical | 9.8 | 2017-09-13 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT UPDAT… |
CVE-2017-14252 | Critical | 9.8 | 2017-09-11 | SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php. |
CVE-2017-14247 | Critical | 9.8 | 2017-09-11 | SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the user_id cookie to header.php, a related issue to CVE-2017-1000060. |
CVE-2017-14119 | High | 8.8 | 2017-09-03 | In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\snmpwalk.php does not properly restrict popen calls, which allows remote attackers… |
CVE-2017-14118 | High | 8.8 | 2017-09-03 | In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\interface.php does not properly restrict exec calls, which allows remote attackers… |
CVE-2017-13780 | High | 7.5 | 2017-08-30 | The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file p… |
CVE-2017-1000060 | Critical | 9.8 | 2017-07-17 | EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root |
CVE-2017-6088 | High | 7.2 | 2017-04-11 | Multiple SQL injection vulnerabilities in EyesOfNetwork (aka EON) 5.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1… |