Drobo 5n2 Firmware
15 CVEs affecting Drobo 5n2 Firmware. Latest disclosed: 2020-02-24. Critical: 7, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-14705 | Critical | 9.8 | 2020-02-24 | In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device o… |
CVE-2018-14709 | Critical | 9.8 | 2018-12-03 | Incorrect access control in the Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to bypass authentication due to insecure token genera… |
CVE-2018-14708 | Critical | 9.8 | 2018-12-03 | An insecure transport protocol used by Drobo Dashboard API on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to intercept network traffic. |
CVE-2018-14706 | Critical | 9.8 | 2018-12-03 | System command injection in the /DroboPix/api/drobopix/demo endpoint on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute sys… |
CVE-2018-14703 | Critical | 9.8 | 2018-12-03 | Incorrect access control in the /mysql/api/droboapp/data endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve the M… |
CVE-2018-14701 | Critical | 9.8 | 2018-12-03 | System command injection in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system… |
CVE-2018-14699 | Critical | 9.8 | 2018-12-03 | System command injection in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system… |
CVE-2018-14707 | High | 7.5 | 2018-12-03 | Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary l… |
CVE-2018-14702 | High | 7.5 | 2018-12-03 | Incorrect access control in the /drobopix/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensit… |
CVE-2018-14700 | High | 7.5 | 2018-12-03 | Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL l… |
CVE-2018-14696 | High | 7.5 | 2018-12-03 | Incorrect access control in the /mysql/api/drobo.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve sensitive… |
CVE-2018-14695 | High | 7.5 | 2018-12-03 | Incorrect access control in the /mysql/api/diags.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve diagnosti… |
CVE-2018-14704 | Medium | 6.1 | 2018-12-03 | Cross-site scripting in the MySQL API error page in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via a malformed URL path. |
CVE-2018-14698 | Medium | 6.1 | 2018-12-03 | Cross-site scripting in the /DroboAccess/delete_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "userna… |
CVE-2018-14697 | Medium | 6.1 | 2018-12-03 | Cross-site scripting in the /DroboAccess/enable_user endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the usernam… |