EUVD-2018-6598

Malware in sbrugna...

CVE-2018-14704

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...

Cross site scripting

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...

CVE-2018-14704

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...

Improper access control

Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnostic information via the "name" URL parameter...

CVE-2018-14696

Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14704

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...

CVE-2018-14704

CVE-2018-14704 affects Drobo 5N2 NAS (firmware around 4.0.5-13.28.96115) with a cross-site scripting vulnerability in the MySQL API error page. The issue arises from unsanitized data in the error page, allowing a remote attacker to execute JavaScript via a malformed URL path. Public references (N...

PT-2018-12675

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns incorrect access control in the "/mysql/api/droboapp/data" endpoint, allowing unauthenticated attackers to retrieve the MySQL database root password. Recommendations For...

PT-2018-12672

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue is related to incorrect access control in the "/mysql/api/logfile.php" endpoint, which allows unauthenticated attackers to retrieve MySQL log files. This is achieved by manipulating...

CVE-2018-14703: Incorrect Permission Assignment for Critical Resource

Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the MySQL database root password...

PT-2018-12667

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns incorrect access control in the "/mysql/api/drobo.php" endpoint, allowing unauthenticated attackers to retrieve sensitive system information. Recommendations For Drobo 5N2...

PT-2018-12676

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns cross-site scripting in the MySQL API error page, allowing attackers to execute JavaScript via a malformed URL path. Recommendations For Drobo 5N2 NAS version...

PT-2018-12666

Name of the Vulnerable Software and Affected Versions Drobo 5N2 NAS version 4.0.5-13.28.96115 Description The issue concerns incorrect access control in the "/mysql/api/diags.php" endpoint, allowing unauthenticated attackers to retrieve diagnostic information. This is achieved via the name URL...

CVE-2018-14704: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...