CVE-2019-10633

CVE-2019-10633 affects Zyxel NAS326 (firmware 5.21 and earlier). It is an eval injection vulnerability in the Python web server routing, enabling a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4, simZysh, and ck6fup6 APIs. Root cause is eval-based handling in the routin...

CVE-2019-10632

A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a lower privileged user to change the location of any other user's files...

CVE-2019-10632

CVE-2019-10632 affects the Zyxel NAS 326 File Browser component (versions 5.21 and earlier). The vulnerability is a directory traversal that lets a lower-privileged user change the location of another user’s files. There are no exploit details provided in the connected documents, and remediation ...

CVE-2019-10631

CVE-2019-10631 describes a Shell Metacharacter Injection in the Zyxel NAS 326 package installer (versions 5.21 and earlier). An authenticated attacker can execute arbitrary code via multiple different requests. Affected product: Zyxel NAS 326 (Hopscotch). Root cause: shell metacharacter handling ...

CVE-2019-10631

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests...

CVE-2019-10630

A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin password of the device...

CVE-2019-10630

CVE-2019-10630 affects Zyxel NAS326 (Hopscotch) up to firmware 5.21, where a plaintext password vulnerability lets an elevated privileged user obtain the device admin password. The root cause is described as plaintext password handling in the affected firmware. The available documents do not spec...

Zyxel NAS 326 Cross-Site Scripting Vulnerability

The Zyxel NAS 326 is a two-drive personal cloud storage device from Zyxel. A cross-site scripting vulnerability exists in Zyxel NAS 326 version 5.21 and earlier. A remote authenticated attacker can exploit this vulnerability to inject arbitrary JavaScript or HTML via the user, group, and file sha...

Zyxel NAS 326 eval injection vulnerability

Zyxel NAS 326 is a two-drive personal cloud storage device from Zyxel Hopscotch. An eval injection vulnerability exists in the Python web server routing in Zyxel NAS 326 5.21 and earlier versions. A remote authenticated attacker can exploit this vulnerability to execute arbitrary code via the...

Drobo NAS Multiple Vulnerabilities in NASd

Drobo NAS are prone to multiple vulnerabilities in NASd. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...

Drobo NAS Multiple Vulnerabilities in DroboPix

Drobo NAS are prone to multiple vulnerabilities in DroboPix. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Drobo NAS Multiple Vulnerabilities in DroboAccess

Drobo NAS are prone to multiple vulnerabilities in DroboAccess. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free softwar...

Drobo DroboPix Detection

Detection of Drobo DroboPix. The script sends a connection request to the server and attempts to detect Drobo DroboPix, s a one-click photo upload solution for mobile devices on Drobo NAS devices. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced...

Drobo NAS Multiple Vulnerabilities in MySQL Web Application

Drobo NAS are prone to multiple vulnerabilities in their MySQL Web Application. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program...

Drobo NAS Detection Consolidation

Consolidation of Drobo NAS detections. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute i...

Drobo NAS Detection (NASd)

NASd based detection of Drobo NAS devices. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.142077...

Drobo DroboAccess Detection

Detection of Drobo DroboAccess. The script sends a connection request to the server and attempts to detect Drobo DroboAccess, a web interface for Drobo NAS devices. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C b...

Netatalk < 3.1.12 - Authentication Bypass Exploit

Exploit Title: Netatalk Authentication Bypass Exploit Author: Jacob Baines Vendor Homepage: http://netatalk.sourceforge.net/ Software Link: https://sourceforge.net/projects/netatalk/files/ Version: Before 3.1.12 Tested on: Seagate NAS OS x8664 CVE : CVE-2018-1160 Advisory:...

Netatalk 3.1.12 - Authentication Bypass

Exploit Title: Netatalk Authentication Bypass Date: 12/20/2018 Exploit Author: Jacob Baines Vendor Homepage: http://netatalk.sourceforge.net/ Software Link: https://sourceforge.net/projects/netatalk/files/ Version: Before 3.1.12 Tested on: Seagate NAS OS x8664 CVE : CVE-2018-1160 Advisory:...

Netatalk 3.1.12 - Authentication Bypass

Netatalk 3.1.12 - Authentication Bypass Exploit Title: Netatalk Authentication Bypass Date: 12/20/2018 Exploit Author: Jacob Baines Vendor Homepage: http://netatalk.sourceforge.net/ Software Link: https://sourceforge.net/projects/netatalk/files/ Version: Before 3.1.12 Tested on: Seagate NAS OS...