CVE-2018-14699: Improper Neutralization of Special Elements used in an OS Command

System command injection in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

CVE-2018-14701: Improper Neutralization of Special Elements used in an OS Command

System command injection in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

CVE-2018-14702: Exposure of Sensitive Information to an Unauthorized Actor

Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

PT-2018-12679

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns the use of an insecure transport protocol by the Drobo Dashboard API, which allows attackers to intercept network traffic. Recommendations For Drobo 5N2 NAS version...

PT-2018-12674

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns incorrect access control in the "/drobopix/api/drobo.php" endpoint, allowing unauthenticated attackers to retrieve sensitive system information. Recommendations For Drobo 5...

PT-2018-12669

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns cross-site scripting that allows attackers to execute JavaScript. This is possible via the "username" URL parameter in the /DroboAccess/delete user endpoint. Recommendation...

CVE-2018-14698: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter...

PT-2018-12677

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns system command injection in the "/DroboPix/api/drobopix/demo" endpoint, allowing unauthenticated attackers to execute system commands via the payload in a POST request...

CVE-2018-14706: Improper Neutralization of Special Elements used in an OS Command

System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request...

PT-2018-12666

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns incorrect access control in the "/mysql/api/diags.php" endpoint, allowing unauthenticated attackers to retrieve diagnostic information. This is achieved via the name URL...

PT-2018-12678

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns a directory traversal vulnerability in the Drobo Pix web application. This allows unauthenticated attackers to upload files to arbitrary locations. Recommendations For Drob...

CVE-2018-14703: Incorrect Permission Assignment for Critical Resource

Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password...

CVE-2018-14709: Improper Authentication

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

CVE-2018-14695: Exposure of Sensitive Information to an Unauthorized Actor

Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter...

CVE-2018-14696: Exposure of Sensitive Information to an Unauthorized Actor

Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14707: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary locations...

CVE-2018-14700: Insertion of Sensitive Information into Log File

Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "name" URL parameter...

PT-2018-12676

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns cross-site scripting in the MySQL API error page, allowing attackers to execute JavaScript via a malformed URL path. Recommendations For Drobo 5N2 NAS version...

CVE-2018-14708: Improper Authentication

An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic...

CVE-2018-14704: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...