CVE-2018-14698

Cross-site scripting in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter...

CVE-2018-14702

Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14706

System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the payload in a POST request...

CVE-2018-14704

Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path...

CVE-2018-14708

CVE-2018-14708 affects Drobo 5N2 NAS with Drobo Dashboard API (version 4.0.5-13.28.96115). The vulnerability arises from using an insecure transport protocol, enabling attackers to intercept network traffic to/from the API. Publicly cited entries (NVD/CNVD) confirm network-interception impact; CV...

CVE-2018-14695

The CVE-2018-14695 entry concerns Drobo 5N2 NAS (version 4.0.5-13.28.96115). The issue is an improper access control in the /mysql/api/diags.php endpoint that allows unauthenticated users to retrieve diagnostic information via the name parameter. Public references note impact as exposure of diagn...

CVE-2018-14698

CVE-2018-14698 concerns a cross-site scripting flaw in Drobo 5N2 NAS, specifically in the /DroboAccess/delete_user endpoint. The vulnerability allows an attacker to inject JavaScript via the username URL parameter in Drobo 5N2 NAS version 4.0.5-13.28.96115. NVD data lists CVSS v3 base score 6.1 (...

CVE-2018-14696

Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive system information...

CVE-2018-14701

System command injection in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...

CVE-2018-14700

CVE-2018-14700 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /mysql/api/logfile.php endpoint. The vulnerability arises from incorrect access control, enabling unauthenticated attackers to retrieve MySQL log files by supplying a name parameter. This exposes partial confidentiality (log...

CVE-2018-14707

CVE-2018-14707 describes a directory traversal in the Drobo Pix web application of Drobo 5N2 NAS (version 4.0.5-13.28.96115). The vulnerability allows unauthenticated attackers to upload files to arbitrary locations. Multiple connected sources corroborate a DroboPix-related path traversal affecti...

CVE-2018-14706

The vulnerability CVE-2018-14706 affects Drobo 5N2 NAS with DroboPix, endpoint /DroboPix/api/drobopix/demo, on version 4.0.5-13.28.96115. It is a system command injection via a crafted POST payload to that endpoint, allowing an unauthenticated attacker to execute arbitrary commands on the device ...

CVE-2018-14704

CVE-2018-14704 affects Drobo 5N2 NAS (firmware around 4.0.5-13.28.96115) with a cross-site scripting vulnerability in the MySQL API error page. The issue arises from unsanitized data in the error page, allowing a remote attacker to execute JavaScript via a malformed URL path. Public references (N...

CVE-2018-14701

CVE-2018-14701 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115) via the /DroboAccess/delete_user endpoint. It allows unauthenticated attackers to inject and execute system commands through the username parameter, with reported impact of potential full command execution on the device. Public expl...

CVE-2018-14703

CVE-2018-14703 affects Drobo 5N2 NAS (version 4.0.5-13.28.96115). The issue is improper access control on the /mysql/api/droboapp/data endpoint, enabling unauthenticated attackers to retrieve the MySQL root password. The NVD entry notes a high-impact condition (CVE-3.0 vector: network, no auth, h...

QNAP QTS Qsync Central Cross-Site Scripting Vulnerability

QNAP QTS is a Turbo NAS operating system from QNAP Systems that provides file storage, management, backup, multimedia applications and security monitoring. It provides file storage, management, backup, multimedia applications and security monitoring, etc. Qsync Central is one of the cloud-based...

QNAP QTS Buffer Overflow Vulnerability (CNVD-2019-08338)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A buffer overflow vulnerability exists in QNAP QTS, which can be exploited by attackers to execute arbitrary code or cause a denial of...

QNAP QTS Command Injection Vulnerability (CNVD-2018-26642)

QNAP QTS is a Turbo NAS operating system from QNAP Systems. The system provides file storage, management, backup, multimedia applications and security monitoring. A command injection vulnerability exists in QNAP QTS. A remote attacker can exploit this vulnerability to run arbitrary commands on th...

Buffer overflow

Buffer Overflow vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could have unspecified impact on the NAS...

CVE-2018-14748

Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QTS 4.2.6 build 20180829 and earlier versions could allow remote attackers to power off the NAS...