CVE-2018-14700

Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "name" URL parameter...

Cross site scripting

Cross-site scripting in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the username URL parameter...

Improper access control

Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

Improper access control

Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter...

Improper access control

Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14703

Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password...

CVE-2018-14701

System command injection in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

CVE-2018-14704

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...

CVE-2018-14709

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

Improper access control

Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password...

CVE-2018-14698

Cross-site scripting in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter...

CVE-2018-14699

CVE-2018-14699 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /DroboAccess/enable_user endpoint. An unauthenticated attacker can inject commands through the username URL parameter, enabling system command execution. Connected sources corroborate a high–critical impact, with CVSS metric...

CVE-2018-14704

CVE-2018-14704 affects Drobo 5N2 NAS (firmware around 4.0.5-13.28.96115) with a cross-site scripting vulnerability in the MySQL API error page. The issue arises from unsanitized data in the error page, allowing a remote attacker to execute JavaScript via a malformed URL path. Public references (N...

CVE-2018-14706

The vulnerability CVE-2018-14706 affects Drobo 5N2 NAS with DroboPix, endpoint /DroboPix/api/drobopix/demo, on version 4.0.5-13.28.96115. It is a system command injection via a crafted POST payload to that endpoint, allowing an unauthenticated attacker to execute arbitrary commands on the device ...

CVE-2018-14697

CVE-2018-14697 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115). A cross-site scripting flaw exists in the /DroboAccess/enable_user endpoint, allowing an attacker to inject and execute JavaScript through the username URL parameter. Public documentation confirms the vulnerability, with related re...

CVE-2018-14701

CVE-2018-14701 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /DroboAccess/delete_user endpoint. It allows unauthenticated attackers to inject and execute system commands through the username parameter, with reported impact of potential full command execution on the device. Public expl...

CVE-2018-14703

CVE-2018-14703 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115). The issue is improper access control on the /mysql/api/droboapp/data endpoint, enabling unauthenticated attackers to retrieve the MySQL root password. The NVD entry notes a high-impact condition (CVE-3.0 vector: network, no auth, h...

CVE-2018-14695

The CVE-2018-14695 entry concerns Drobo 5N2 NAS (version 4.0.5-13.28.96115). The issue is an improper access control in the /mysql/api/diags.php endpoint that allows unauthenticated users to retrieve diagnostic information via the name parameter. Public references note impact as exposure of diagn...

CVE-2018-14696

Drobo 5N2 NAS vulnerability (CVE-2018-14696) due to Incorrect access control in the /mysql/api/drobo.php endpoint. Affects Drobo 5N2 NAS version 4.0.5-13.28.96115. Allows unauthenticated attackers to retrieve sensitive system information. The connected sources confirm the issue and the affected c...

CVE-2018-14700

CVE-2018-14700 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /mysql/api/logfile.php endpoint. The vulnerability arises from incorrect access control, enabling unauthenticated attackers to retrieve MySQL log files by supplying a name parameter. This exposes partial confidentiality (log...