Cross site scripting

Cross-site scripting in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter...

CVE-2018-14703

Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password...

CVE-2018-14709

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

CVE-2018-14696

Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

Authentication flaw

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

CVE-2018-14702

Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14709

CVE-2018-14709 affects Drobo 5N2 NAS (Dashboard API) where insecure token generation allows authentication bypass. Public details in the provided documents indicate remote command injection via the NASd service, enabling attackers to perform actions such as querying device status, installing appl...

CVE-2018-14697

Cross-site scripting in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the username URL parameter...

CVE-2018-14696

Drobo 5N2 NAS vulnerability (CVE-2018-14696) due to Incorrect access control in the /mysql/api/drobo.php endpoint. Affects Drobo 5N2 NAS version 4.0.5-13.28.96115. Allows unauthenticated attackers to retrieve sensitive system information. The connected sources confirm the issue and the affected c...

CVE-2018-14697

CVE-2018-14697 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115). A cross-site scripting flaw exists in the /DroboAccess/enable_user endpoint, allowing an attacker to inject and execute JavaScript through the username URL parameter. Public documentation confirms the vulnerability, with related re...

CVE-2018-14709

Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token generation...

CVE-2018-14707

Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary locations...

CVE-2018-14703

Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password...

CVE-2018-14699

CVE-2018-14699 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /DroboAccess/enable_user endpoint. An unauthenticated attacker can inject commands through the username URL parameter, enabling system command execution. Connected sources corroborate a high–critical impact, with CVSS metric...

CVE-2018-14704

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...

CVE-2018-14702

Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14706

System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request...

CVE-2018-14698

Cross-site scripting in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter...

CVE-2018-14708

CVE-2018-14708 affects Drobo 5N2 NAS with Drobo Dashboard API (version 4.0.5-13.28.96115). The vulnerability arises from using an insecure transport protocol, enabling attackers to intercept network traffic to/from the API. Publicly cited entries (NVD/CNVD) confirm network-interception impact; CV...

CVE-2018-14700

CVE-2018-14700 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /mysql/api/logfile.php endpoint. The vulnerability arises from incorrect access control, enabling unauthenticated attackers to retrieve MySQL log files by supplying a name parameter. This exposes partial confidentiality (log...